| Category | Started On | Completed On | Duration | Cuckoo Version |
|---|---|---|---|---|
| FILE | 2014-07-18 01:18:37 | 2014-07-18 01:22:04 | 207 seconds | 1.2-dev |
| Machine | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| machine3 | winxpmacine3 | VirtualBox | 2014-07-18 01:18:38 | 2014-07-18 01:22:04 |
File Details
| File name | aug14bcl-b4.pdf | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| File size | 22085 bytes | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File type | PDF document, version 1.6 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CRC32 | 14F2BA55 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| MD5 | 42180820caeff7ee48b376cb30be1334 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA1 | 9689a5d1963dcdeec16cea6775e3000bb53d8687 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA256 | 394e2c33ac1bd1f77635d9462ea92852ac88fbf747c7931ff542c236576c6801 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA512 | 740a98cfc0265f9667f5997a6f538548457e19677d1482ddb3326f9e42caf0e1bf74734f5dfa6c8762f325702de506862ce701cf2c8d56fdb5c33254e3085668 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Ssdeep | None | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| PEiD | None matched | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Yara | None matched | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| VirusTotal |
Permalink VirusTotal Scan Date: 2014-07-17 01:43:12 Detection Rate: 0/54 (Expand)
|
Signatures
Starts servers listening on 127.0.0.1:0, 0.0.0.0:0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate)
Steals private information from local Internet browsers
Installs itself for autorun at Windows startup
Screenshots
Static Analysis
Dropped Files
Network Analysis
Hosts Involved
| IP Address |
|---|
| 10.129.0.10 |
| 10.129.0.255 |
| 23.37.9.92 |
| 23.62.6.171 |
| 23.62.6.218 |
| 23.62.6.216 |
| 23.62.6.203 |
| 23.62.6.163 |
DNS Requests
| Domain | IP Address |
|---|---|
| service-updates.adobe.com | 23.37.9.92 |
| acroipm2.adobe.com | 23.62.6.163 |
| armmf.adobe.com | 23.37.9.92 |
Behavior Summary
Files
- C:\DOCUME~1
- C:\DOCUME~1\TDW
- C:\DOCUME~1\TDW\LOCALS~1
- C:\DOCUME~1\TDW\LOCALS~1\Temp
- C:\Documents and Settings\TDW\Local Settings\Temp\aug14bcl-b4.pdf
- C:\Documents and Settings\TDW
- C:\Documents and Settings\TDW\Local Settings\Temp
- C:\WINDOWS\system32\KBDUS.DLL
- C:\WINDOWS
- C:\Program Files\Adobe
- C:\Program Files\Adobe\Reader 11.0\Reader
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx
- C:\Documents and Settings\TDW\Application Data\Adobe
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color
- C:\Documents and Settings\TDW\Application Data\Microsoft\Speech
- C:\WINDOWS\system32
- C:\Documents and Settings\TDW\Local Settings\Application Data\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\
- C:\Documents and Settings\TDW\
- C:\Documents and Settings\TDW\Local Settings\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color\ACECache11.lst
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\
- C:\WINDOWS\system32\rsaenh.dll
- C:\Documents and Settings\TDW\Application Data\
- C:\Documents and Settings\TDW\Application Data\Adobe\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdr.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdri.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages
- PIPE\wkssvc
- IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
- MountPointManager
- STORAGE#Volume#1&30a96598&0&SignatureC7EDC7EDOffset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
- C:\Documents and Settings
- C:\Documents and Settings\TDW\My Documents
- C:\Documents and Settings\TDW\My Documents\desktop.ini
- C:\Documents and Settings\All Users
- C:\Documents and Settings\All Users\Documents
- C:\Documents and Settings\All Users\Documents\desktop.ini
- C:\Documents and Settings\TDW\Desktop
- C:\Documents and Settings\All Users\Desktop
- C:\WINDOWS\Registration\R000000000007.clb
- C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\UserCache.bin
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab
- C:\Documents and Settings\TDW\Application Data\desktop.ini
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\H24JT5G9
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal
- C:\Documents and Settings\TDW\Local Settings\Temp\
- PIPE\lsarpc
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R660D.tmp
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files
- C:\Documents and Settings\TDW\Local Settings\History
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\
- C:\
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- C:\Documents and Settings\TDW\Cookies\
- C:\Documents and Settings\TDW\Cookies\index.dat
- C:\Documents and Settings\TDW\Local Settings\History\History.IE5\
- C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat
- C:\WINDOWS\system32\userenv.dll
- c:\autoexec.bat
- C:\Documents and Settings\TDW\Local Settings
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\Certificates\*
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CRLs\*
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CTLs\*
- C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
- C:\WINDOWS\system32\Ras\*.pbk
- C:\Documents and Settings\TDW\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
- C:\Documents and Settings\TDW\Cookies\tdw@adobe[2].txt
- C:\WINDOWS\system32\shell32.dll
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\assets
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R660E.tmp
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\A9R660E.tmp
Mutexes
- Global\ARM Update Mutex
- Global\Acro Update Mutex
- {100184D2-BDC3-477a-B8D3-65548B67914C}_440
- _!MSFTHISTORY!_
- c:!documents and settings!tdw!local settings!temporary internet files!content.ie5!
- c:!documents and settings!tdw!cookies!
- c:!documents and settings!tdw!local settings!history!history.ie5!
- WininetStartupMutex
- WininetConnectionMutex
- WininetProxyRegistryMutex
Registry Keys
- HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\Privileged
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0
- HKEY_LOCAL_MACHINE\Software\Adobe\Adobe Acrobat\11.0\Security
- HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\11.0\Installer
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003
- Keyboard Layout\Preload
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
- HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
- HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
- HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
- HKEY_CURRENT_USER\
- HKEY_CLASSES_ROOT\
- HKEY_LOCAL_MACHINE\
- HKEY_USERS\
- HKEY_CURRENT_CONFIG\
- HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\11.0
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0
- HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer\11.0
- HKEY_CURRENT_USER\Software\Adobe\CommonFiles\Usage\Reader 11
- HKEY_LOCAL_MACHINE\SOFTWARE\Justsystem\ATOK\Setup\Folder
- HKEY_LOCAL_MACHINE\System
- HKEY_LOCAL_MACHINE\System\Acrobatbrokerserverdispatchercpp789
- Software\Adobe\Acrobat Reader\11.0\Installer\Migrated
- Language
- Software\Adobe\Adobe Synchronizer\11.0
- Software\Adobe\Adobe Synchronizer\11.0\SOFTWARE\Microsoft\Cryptography\Providers\Type 001
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Offload
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\SOFTWARE\Microsoft\Cryptography\Providers\Type 001
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe
- HKEY_CLASSES_ROOT\.exe
- HKEY_CLASSES_ROOT\exefile
- HKEY_CLASSES_ROOT\exefile\CurVer
- HKEY_CLASSES_ROOT\exefile\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- HKEY_CLASSES_ROOT\exefile\\ShellEx\IconHandler
- HKEY_CLASSES_ROOT\SystemFileAssociations\.exe
- HKEY_CLASSES_ROOT\SystemFileAssociations\application
- HKEY_CLASSES_ROOT\exefile\\Clsid
- HKEY_CLASSES_ROOT\*
- HKEY_CLASSES_ROOT\*\Clsid
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e6c716a0-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e6c716a2-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a2-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a0-b561-11e1-9849-806d6172696f}\
- HKEY_CLASSES_ROOT\Directory
- HKEY_CLASSES_ROOT\Directory\CurVer
- HKEY_CLASSES_ROOT\Directory\
- HKEY_CLASSES_ROOT\Directory\\ShellEx\IconHandler
- HKEY_CLASSES_ROOT\Directory\\Clsid
- HKEY_CLASSES_ROOT\Folder
- HKEY_CLASSES_ROOT\Folder\Clsid
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
- HKEY_CLASSES_ROOT\CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
- HKEY_CLASSES_ROOT\.ade
- HKEY_CLASSES_ROOT\.adp
- HKEY_CLASSES_ROOT\.app
- HKEY_CLASSES_ROOT\.asp
- HKEY_CLASSES_ROOT\.bas
- HKEY_CLASSES_ROOT\.bat
- HKEY_CLASSES_ROOT\.cer
- HKEY_CLASSES_ROOT\.chm
- HKEY_CLASSES_ROOT\.cmd
- HKEY_CLASSES_ROOT\.com
- HKEY_CLASSES_ROOT\.cpl
- HKEY_CLASSES_ROOT\.crt
- HKEY_CLASSES_ROOT\.csh
- HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003_Classes
- HKEY_LOCAL_MACHINE\Software\Classes
- \REGISTRY\USER
- HKEY_LOCAL_MACHINE\Software\Classes\CLSID
- CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServerX86
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandler32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandlerX86
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InProcServer32
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Ranges\
- HKEY_LOCAL_MACHINE\System\Setup
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\C\
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
- HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Handler\C
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\C
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- HKEY_CLASSES_ROOT\exefile\\shell\open
- HKEY_CLASSES_ROOT\exefile\\shell\open\command
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe
- HKEY_CLASSES_ROOT\exefile\\shell\open\ddeexec
- HKEY_CLASSES_ROOT\Applications\Eula.exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer
- CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}
- CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\TreatAs
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocServer32
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocServerX86
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocHandler32
- HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
- HKEY_CLASSES_ROOT\AppID\AcroRd32.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName
- ActiveComputerName
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles
- Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path1
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path2
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path3
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path4
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014071820140719
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AUTOPROXY_CACHE_ANAME_KB921400
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TEMPORARYFILES_FOR_NOCACHE_840387
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TEMPORARYFILES_FOR_NOCACHE_840386
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CHUNK_TIMEOUT_KB914453
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CERT_TRUST_VERIFIED_KB936882
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENSURE_FQDN_FOR_NEGOTIATE_KB899417
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_DISABLE_NTLM_PREAUTH_IF_ABORTED_KB902409
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WPAD_STORE_URL_AS_FQDN_KB903926
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_KEEP_CACHE_INDEX_OPEN_KB899342
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WAIT_TIME_THREAD_TERMINATE_KB886801
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 1
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\PhysicalStores
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Environment
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Volatile Environment
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\Certificates
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\CRLs
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\CTLs
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\Keys
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
- HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing
- HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RASAPI32
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\windows\CurrentVersion\Internet Settings
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
- HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_URLHOSTNAME
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Domains\adobe.com
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adobe.com
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\ProtocolDefaults\
Processes
registry filesystem process services network synchronization
AcroRd32.exe PID: 440, Parent PID: 236
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|---|---|---|---|---|---|
| 09:15:14,484 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:14,494 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsAlloc FunctionAddress => 0x00522e5c ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:15:14,494 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsGetValue FunctionAddress => 0x00522e50 ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:15:14,494 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsSetValue FunctionAddress => 0x00522e44 ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:15:14,494 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsFree FunctionAddress => 0x00522e3c ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:15:14,504 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:14,574 | 444 | LdrLoadDll |
Flags => 1244460 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,574 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CommandLineToArgvW FunctionAddress => 0x7ca41348 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,574 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,574 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsWow64Process FunctionAddress => 0x7c815229 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:14,584 | 444 | RegOpenKeyExW |
Handle => 0x00000080 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:14,584 | 444 | RegQueryValueExW |
Handle => 0x00000080 DataLength => 4 ValueName => bProtectedMode Type => 1242528 |
FAILURE | 0x00000002 | |
| 09:15:14,584 | 444 | RegCloseKey |
Handle => 0x00000080 |
SUCCESS | 0x00000000 | |
| 09:15:14,584 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:14,584 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sftldr.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,594 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sftldr_wow64.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,594 | 444 | FindWindowA |
ClassName => 32770 WindowName => _AcroAppTimer |
FAILURE | 0x00000000 | |
| 09:15:14,594 | 444 | RegOpenKeyExW |
Handle => 0x0000008c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:14,594 | 444 | RegQueryValueExW |
Handle => 0x0000008c DataLength => 4 ValueName => bEnableAlternateTempDirectory Type => 1244632 |
FAILURE | 0x00000002 | |
| 09:15:14,594 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:14,594 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableAlternateTempDirectory Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:14,594 | 444 | RegCloseKey |
Handle => 0x0000008c |
SUCCESS | 0x00000000 | |
| 09:15:14,594 | 444 | RegOpenKeyExW |
Handle => 0x0000008c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:14,594 | 444 | RegQueryValueExW |
Handle => 0x0000008c DataLength => 4 ValueName => bEnableAlternateLaunchDesktop Type => 1244632 |
FAILURE | 0x00000002 | |
| 09:15:14,594 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:14,594 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableAlternateLaunchDesktop Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:14,594 | 444 | RegCloseKey |
Handle => 0x0000008c |
SUCCESS | 0x00000000 | |
| 09:15:14,594 | 444 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Adobe\Adobe Acrobat\11.0\Security |
FAILURE | 0x00000002 | |
| 09:15:14,594 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,594 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SetProcessDEPPolicy FunctionAddress => 0x7c862144 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:14,594 | 444 | NtOpenMutant |
Handle => 0x7c80ae80 MutexName => Global\ARM Update Mutex |
FAILURE | 3221225524 | |
| 09:15:14,594 | 444 | NtOpenMutant |
Handle => 0x7c80ae80 MutexName => Global\Acro Update Mutex |
FAILURE | 3221225524 | |
| 09:15:14,594 | 444 | FindWindowW |
ClassName => AdobeAcrobatSpeedLaunchCmdWnd WindowName => |
FAILURE | 0x00000000 | |
| 09:15:14,594 | 444 | FindWindowW |
ClassName => AdobeReaderSpeedLaunchCmdWnd WindowName => |
FAILURE | 0x00000000 | |
| 09:15:14,604 | 444 | LdrLoadDll |
Flags => 1244448 BaseAddress => 0x77690000 FileName => NTMARTA.DLL |
SUCCESS | 0x00000000 | |
| 09:15:14,604 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccFreeIndexArray FunctionAddress => 0x77698632 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,604 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccTreeResetNamedSecurityInfo FunctionAddress => 0x77699253 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,604 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetInheritanceSource FunctionAddress => 0x77698e1d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,604 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountTrustee FunctionAddress => 0x776a6901 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,604 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetNamedRights FunctionAddress => 0x776925cd ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetNamedRights FunctionAddress => 0x7769324d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetHandleRights FunctionAddress => 0x776930d1 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetHandleRights FunctionAddress => 0x77692f83 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetEntriesInAcl FunctionAddress => 0x77692a56 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetExplicitEntriesFromAcl FunctionAddress => 0x77699ec8 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountName FunctionAddress => 0x776a52d2 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountSid FunctionAddress => 0x776a64b3 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccSetEntriesInAList FunctionAddress => 0x776a5c9a ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertAccessToSecurityDescriptor FunctionAddress => 0x776a5d8d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertSDToAccess FunctionAddress => 0x776a5e9c ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetAccessForTrustee FunctionAddress => 0x776a6050 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertAclToAccess FunctionAddress => 0x776a60c9 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetExplicitEntries FunctionAddress => 0x776a628b ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | CreateThread |
ThreadId => 0 StartRoutine => 0x0040c2a0 Parameter => 0x0039a880 CreationFlags => 0 |
SUCCESS | 0x000000d0 | |
| 09:15:14,615 | 444 | RegOpenKeyExW |
Handle => 0x000000d4 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | RegQueryValueExW |
Handle => 0x000000d4 DataLength => 4 ValueName => bEnableHeapMitigations Type => 1244592 |
FAILURE | 0x00000002 | |
| 09:15:14,615 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:14,615 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableHeapMitigations Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:14,615 | 444 | RegCloseKey |
Handle => 0x000000d4 |
SUCCESS | 0x00000000 | |
| 09:15:14,615 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,625 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HeapAlloc FunctionAddress => 0x7c9100a4 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:14,625 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HeapFree FunctionAddress => 0x7c90ff0d ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:14,625 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,625 | 444 | VirtualProtectEx |
Protection => 0x00000080 ProcessHandle => 0xffffffff Address => 0x004fc38c Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:15:14,625 | 444 | VirtualProtectEx |
Protection => 0x00000002 ProcessHandle => 0xffffffff Address => 0x004fc38c Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:15:14,625 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,625 | 444 | VirtualProtectEx |
Protection => 0x00000080 ProcessHandle => 0xffffffff Address => 0x004fc414 Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:15:14,625 | 444 | VirtualProtectEx |
Protection => 0x00000002 ProcessHandle => 0xffffffff Address => 0x004fc414 Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:15:14,625 | 444 | LdrLoadDll |
Flags => 1244440 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,625 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitializeEx FunctionAddress => 0x774fef7b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,625 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\rpcss.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,625 | 444 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => coB\xdc\x9a\xc7V\x0f\x8eYc\x11\x0f\x0eBO\xda\xed\x94\x1d\x9d\xbf\xd4\xe1\xc7\xa3\xabb\xb3lI\x0c\x87\xd5\xf9K<\x0c\xbc*\x18\x1f hv\xad\xa8*S\x15\x83\xf82P3R\xf1\x00/\xac\xea\xefQ\x9e7i;gkT\x7f 1\x92\x1a\xc4\x0eaZ\xd8\xb7e\xbb\xad\x7f\xbb\xbd\xa5o\x1b\x04\x8b\xf0\xbf\x0e\xad\xa4\xed\xca~=3\xc9\x06`h\8-\xaa\x8c\xebWl\xe3\xed\xb9\x1f'\xd6\xcc\x87B\xac\xd2D\xa8N\xb3o\xa4\xd6K\xfe\xd9Z\xbal\xf0\xd3x\\xaa\xf2D^\xc2)\xb9l\xc1~\x12W\x0f\xc3\xe9\xa2\x8b\xbe\xf5<\xd2\x9d\\x19\xec\x9b\xf5KT\x93\x9d8\x12\xba\xe1\xb9\xc7\xc5?\x8c\x88\xbd\xe9\xd9U\x7fh)\x94{\x11\x9bK\xe8\xc8\xf3\x9b>\x8f\x1e\xdfz\xfaw\xe5\x1e\x07\xfa\xdfu-\xce\xadA)\xedXu\xf6@6\x8b\xde\xd97\xd9\xf8\xecjo\xbaG\xddp(Ez\xb7\x14u=\xe3\x0f\xda\x8d\xb8]\xd0\xa0+\x1b\xe5\xd0\xbf IoControlCode => 3735560 InBuffer => \xab\xb1r8m\xe7\x90\xd5\xa9\xc9\xb3\x0b\xfd,\xd51a\x93\xb2cn\xe1r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:14,625 | 444 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \xe6\x9e\x80\xab:\xa0\x0c\xee+\x11 \x18\xb4\xb6\x1f\xfa\x16\x06\x03\xdc\xa13\x85\xb9\xef\xf2\xed\xd29#\xb93d\x07 \x1a\xbb\x94\x86M6\xf8\x83@\x8c\xca\xfd\x9a\xc6 \xaea\xff\xb1\xa0pg\xa1C\x9c\xf1y\xca\xf0m\x1d\x847\xd8\xcb\xd6\x0e\xef*\xed\xdd\xf0\xbe\x07\x16\xb6\xb6\x12\xa4\x15\x19\x19\xf7\x17\x1f\x0e^0\xe3W&\xbar\x80\xdc\xc8,0{\xbf\xa4\xc8\x1a\x1dI*\x83O~,\xb5\xb8\xfb^\x91B\xdb}\xd2P7\x10\\xa9\x0b\x17\xc8\x86\x17\xd5\xfa\xf6U\x83kbj\xec\x89\xf9\x02\xbf=\xd3\xa7\x0b\xe7;\xb3\xbd\xb9l\x06uS\xb7Iu\xf3\xc5\x84\xecbn\xe9\xef7V\xc4HG0\xb5\xcfrX\xef\xf6j\xfc>\xaf{\xf6m\xdf8Z\xa4QMl\xa6`w\xc5\x97\xca\xb9R|\xed\x84[\x1f3\xc6\.\xb9\x91\xa3\x1b\xe0mu\xfbO\xee\x06\xc1\xfb\xa7\xfa\xa5\xfeh\xe9\x15\x1b\xa1`I\x1a\xfa\xc0>\x1e\x03\xb0\x82\xa7\x05\x0c\xc4d\\xde\xf1\xe5\xcc IoControlCode => 3735560 InBuffer => \xab\xb1r8m\xe7\x90\xd5\xa9\xc9\xb3\x0b\xfd,\xbaB,\xac2\xeeWc3a\x93\xb2cn\xe1r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:14,635 | 444 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \x90\x8e|\xfdtV\xdb\x11\xd9\x04\x8b\xee\xbe:NS\x19\x92\xbaS\x13@\x8b\xdf\x87L\xdb\x90\xb0\xefi!\xf79\x18\xa7\\x07\xc3<\xc0\xa8\x9b\x97\x8ej\xc5-\xd2>\xdd\x9b\xbaJ\xedf\xe2\x1e\xfd\x17\xc1p\x96\x9aBb\xbf.\xd8\xf4MsNaj\xaf\xd4rWr\x11\x89\x1b\xac\x07\x17\xbc.q~o\xf9\x80\xc6\x8b\xde\x1eX{\xe7S\xa9\x7f\x82\xa70I\xe22\xdew\x16\x0f\x19\x0f\x8bd\xf8\x86\xdd\x942c1\xff\x02\xa6\xe6C3(Y\xf2\x94"\xc0\xb5t\xc9\xdcf\x03s\xad\xaawd\xcd\xf1D\x19\xc6\xdcTg&[\xf2m\xb5 \xd4\xce\xef\xf5C>\xa9\xdf\xa5\x00\x8bQ\xe2\xbb\x1fe\x8b\x8f\x10\xe8-\xc9\xbdM1\xd2N\x15\x86O\xab\xa1\x92\x87\xbfz\xe6\xdb\x08r{T\xa9\xfe6\x9b~\xc5\xb0\x0b\x0cp5\x9cO\xff\x02\x14\xbc\xa7\xd8\x98\xa1\x98,\x08\xb0\xb5\x1e\xa6\xb6x\x92\xac\xd25[\x01\xf2-\xe0\x03\xfab\x94 \xa0\xf5nB\x85\xcc\x84\x8a\x9d IoControlCode => 3735560 InBuffer => \xab\xb1r8m\xe7\x90\xd5\xa9\xc9\xb3\x0b\xfd,\xbaB,\xac2\xeeW\x0c@,\xac2\xeeWc3a\x93\xb2cn\xe1r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:14,635 | 444 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => M\xbd\x18=&[,KG\x00\xe1&:P.\xac\xab\xa3\xeb\xd5>u\xd3\x19\x08\x19\x0f\x06\x8b}\x07\xacy\xeb\xfd\xddxY\x85P\x8fe-\xcdrv\x81\x11\xe1LE@\xb6\x90\xa2H\x9cI\\xc1\xbb\x19\xa6\x8a\xd8\xb0\xe6\x1c\x908K_\x07 r\xfc=\xf6\x13\x9f\xcf&#\x9e\xeb s\xee\xa37=\x01\xbb\xf0\xb4H\"\xcd#z\xd3\xcc\xfdn\xac\xbc\xc1\xac,T\xa2\xfaq\x07\xef\x8b\x1e'\xd80\x8f\xb6\xfb\xb8\x9f\xdc{\xe7\x17\x01\xc5o\xd7/\x18r9q-8_\xdf\xa4[\x822\xb5\xdc\x02\x0c\xc7\xa1Q\xf6\x97\xee2\x02\xc4\x18\x8f\xa3s\xc5\x10O \xda7"~e\x19\xf5\x02\xfa\x1c\x91W\x03\xa5\xa9\xfa\xc15\xf0\x06\xea\x12x\xf0\x86\xf1=\xbb\x8bcv\xba\xf5\xea\x00~\x895\x02\xb2\xee4,:X\xe6\x1c\xaa\x90pvY\x80\xee\xbe\x08Uc\xc7J<\x95i\xe0\x1c\xfb\x1d\x17%\x01D\x18\x05F\x17\x88\xb9\xed\xe5R\xd5A\xe7,\xc7\xcc\x08\x13 IoControlCode => 3735560 InBuffer => \xab\xb1r8m\xe7\x90\xd5\xa9\xc9\xb3\x0b\xfd,\xbaB,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeWc3a\x93\xb2cn\xe1r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:14,635 | 444 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \x84\xb9\x0c\xbec\xddD"J\x16r \xa8\xbe\xab\xdd\xfe\x0eE\x9e\xccF\xc66\x19\xb1\x8f\xc5n\xa9\xa8\xc6\xe7\x9fT\xee\xf4\xdc\x99aTCd\x08\xd8\x8a\xe5\xd4*\xbaT\xff\xe3\x1d\x908Yf\xb0\xf2F\xf2\xfe \x9e\xb9w\x8fq\x8f\xe4Z\x9b\xa2\xb63\xc1\x03\xd9\xf9\xf3o\xee]\x82e,C\x83\xdf\x1f\xd8\x864N\x0e\xe0\xa4\x82#jQM&\xb4\x1f\xcb\xa4\xe1\xff\x8b+\xcaj\xd8\x01\x00\x02\x17\xbbY\xb31/\x83\x8e\\x10qK\xce!\x98-*^ju\xa6\x97"<\xfc^a\xc3\xbf-'$\xe0\xca\xfb5\x16\xfd\x00X\xd2LI\x9b\xdd\x9el\xe7\xeb\x15\xf6\xa2\x9aoGU\xff~\x02}\x8b\xd1\x92\x85\xcc\x1a\xcc\x8d \x1e\x82;\xa0Q,\x9f?\x1a\x82 \xb7k\xb9\xe6/)\xbf\xbc\xac3\xc4;3ht\xa0u\x1c\x8d\xc7\xd4\x0c\xe7\xa2!j\x08\xa0\xfe\xa1\xbat*:\xe4n\x82\x85:*\xf8\xd7;< 7\xf6\x0b_d6\x97\xaf\x10\xa7\x99\xf2o IoControlCode => 3735560 InBuffer => \xab\xb1r8m\xe7\x90\xd5\xa9\xc9\xb3\x0b\xfd,\xbaB,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeWc3a\x93\xb2cn\xe1r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:14,635 | 444 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \xcfY\xce\xf3\xca\x85+\x05\x92u\x07v\x91qH>#\xcf|\xf5N]J9`\xed\xf9\xb5"\xf6\xbb3\x16U\x8e-\x87*-\xa7\xbaz<\x17\x80}.\xaa\xf3i \x06E5\xd19/\xaf/-\x8b\xf2\x1c\x03 \xfe\xf8\xd3\xd2\xeb\x9e\xe0B\x8c\xd6\x88\x13\xfe\xe7\xfa\xcfg\xf8\xaf\x8f#\xe1zm\xb6\xfdK1\xe4w\xed\xf4\x1e\x82\x89 \x16`\xbdd\x8f\xc2\xe0c \xea\xa1\xce\xda:\xce!|\x0e\x05\xc0\xd8\x00\x85\xea\xcc\xdc\xb3\x05&\xb3-\xdd%\xf4\xd1\xea\xc4c\x8d\xd6\\x81r\xcb\xd7i\xe2k\x0e\xa6L\xd9\xc3\xd8\x8bQ\xeeZ%\xd9\xbf\xbd\xaa\x8d\xf6\xabJ\xf9\x9b\x1a\xc8\xeb\x04\xdc\x06\x9d\xf6_i\x1b\x85\xdeK\xe5\xb3,3|\xd7\xe7\xbf\x953W\xe5\x8b\xee\xe2*n\xbe\xee_\xad1\xec\x1e#\xb7<\x8f\xdc8\xee\x15\xc9K&\xd7h\x91(\x88\xa6\x88\x92Fh\x9fn \xcc\xd1\xbf\x81\xaa\xcaZ\x88\xeb\xfd\xea\x12\xca\xf2p<#52?\x8f\x96\x19\xec IoControlCode => 3735560 InBuffer => \xab\xb1r8m\xe7\x90\xd5\xa9\xc9\xb3\x0b\xfd,\xbaB,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeWc3a\x93\xb2cn\xe1r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:14,635 | 444 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \xb4\xd8\xb4\xe1\xce\x93\xc9\xb3\xd0%\xee\xfbi\xff,\x86o`u\x908x\x05\x92\xf2\xffS\x18\xdb\xf8\xd2K\xbb\xc1u\xc2\x8b\x84\x1ezv\xd1g\xcaS\xb8\x90g\x80\x0c\xd3\xde`O\x1fze\x8ef\xdd\xa0^\xe0=Xis#\xd3\xc0\xbeK\x86\xe31rjnf\xc9tD\x98\xd6\x9e\xabJN\xa8\xd4IZ\x94\xfbS\xd3\x17\x82\xb2\x06\xeb\x8b(\x9a\xe5\x81D\xa0\x87J\xefY\xa5'zUr\xc8q\x85/ap\xb0\x9aBB)8R-\xd8\x84{\x08\xb5\xa9\xa4|j\xa8\xd2N\xc0\xa3\xc06\x81u\xfd1\x7f\xd1\xafB\xca \xac\xedY\xe2qv)\x9d@\xac\xb3\x0b\x81\xe8\x08A\xbd\x8f\x95\xae\xec\x1cZ70\xa2\xd5\x06\x13\x800 BH\x1bt*\xbb|<^\xc6,\x7f\xf0\xd5\x17\x8c\xa6\x8a\xf91\x15D\xda\xf5\x8fz\xa0\x9e\x8eW\xbe\x82r\x91o*\xf1\xbb\xa7Y\x15\xa6yw5\xd0\xedt;\x97\xcd\xde\xe9d\xce8\x0c\x03\xd2\xaf\xff\xca\x80\xb1\x15x\xf3 IoControlCode => 3735560 InBuffer => \xab\xb1r8m\xe7\x90\xd5\xa9\xc9\xb3\x0b\xfd,\xbaB,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeW\x0c@,\xac2\xeeWc3a\x93\xb2cn\xe1r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:14,635 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | 1 time |
| 09:15:14,635 | 444 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:14,635 | 444 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnforceReadRestrictions Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:15:14,635 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:14,635 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnforceReadRestrictions Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:14,635 | 444 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:14,635 | 444 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:14,635 | 444 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableGlobalAtomRestrictions Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:15:14,635 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:14,635 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableGlobalAtomRestrictions Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:14,635 | 444 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:14,635 | 444 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:14,635 | 444 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bPreventCreatingExecutables Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:15:14,645 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:14,645 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bPreventCreatingExecutables Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:14,645 | 444 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableBinaryPlantingProtection Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:15:14,645 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:14,645 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableBinaryPlantingProtection Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:14,645 | 444 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableSameObjectCheck Type => 1244160 |
FAILURE | 0x00000002 | |
| 09:15:14,645 | 444 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bFilePathPreprocessingShortcutEnabled Type => 1244160 |
FAILURE | 0x00000002 | |
| 09:15:14,645 | 444 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | LdrLoadDll |
Flags => 1243912 BaseAddress => 0x77dd0000 FileName => ADVAPI32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SystemFunction036 FunctionAddress => 0x77dd8292 ModuleHandle => 0x77dd0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegQueryValueExW |
Handle => 0x000000d8 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:14,645 | 444 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:14,655 | 444 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x001d11a8 | |
| 09:15:14,655 | 444 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x001d11a8 | |
| 09:15:14,655 | 444 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x001d11a8 | |
| 09:15:14,655 | 444 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x001d11a8 | |
| 09:15:14,655 | 444 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14bcl-b4.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:14,655 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0018a9a8 | |
| 09:15:14,655 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x0018a9a8 | |
| 09:15:14,655 | 444 | NtOpenDirectoryObject |
DirectoryHandle => 0x000000d8 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:14,665 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0018a9a8 | |
| 09:15:14,665 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x0018a9a8 | |
| 09:15:14,675 | 444 | LdrLoadDll |
Flags => 1242576 BaseAddress => 0x71b20000 FileName => MPR.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,675 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WNetGetUniversalNameW FunctionAddress => 0x71b2c7a6 ModuleHandle => 0x71b20000 |
SUCCESS | 0x00000000 | |
| 09:15:14,675 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1 |
FAILURE | 0x00000002 | |
| 09:15:14,675 | 444 | CreateThread |
ThreadId => 468 StartRoutine => 0x00420110 Parameter => 0x00d9c860 CreationFlags => 0 |
SUCCESS | 0x000000f0 | |
| 09:15:14,675 | 444 | CreateThread |
ThreadId => 504 StartRoutine => 0x00420670 Parameter => 0x00d558c0 CreationFlags => 0 |
SUCCESS | 0x000000fc | |
| 09:15:14,675 | 444 | RegOpenKeyExW |
Handle => 0x00000100 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:14,675 | 444 | RegQueryValueExW |
Handle => 0x00000100 DataLength => 4 ValueName => bDisableCryptBroker Type => 1243612 |
FAILURE | 0x00000002 | |
| 09:15:14,675 | 444 | RegCloseKey |
Handle => 0x00000100 |
SUCCESS | 0x00000000 | |
| 09:15:14,675 | 444 | CreateThread |
ThreadId => 488 StartRoutine => 0x00421670 Parameter => 0x00d9d860 CreationFlags => 0 |
SUCCESS | 0x00000108 | |
| 09:15:14,675 | 444 | CreateThread |
ThreadId => 472 StartRoutine => 0x004217e0 Parameter => 0x00d9c8d0 CreationFlags => 0 |
SUCCESS | 0x00000114 | |
| 09:15:14,675 | 444 | CreateThread |
ThreadId => 508 StartRoutine => 0x004219b0 Parameter => 0x00d55980 CreationFlags => 0 |
SUCCESS | 0x00000120 | |
| 09:15:14,675 | 444 | CreateThread |
ThreadId => 348 StartRoutine => 0x00421e70 Parameter => 0x0039a8e8 CreationFlags => 0 |
SUCCESS | 0x0000012c | |
| 09:15:14,685 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitialize FunctionAddress => 0x77502a53 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:14,695 | 444 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000140 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:14,695 | 444 | NtOpenKey |
DesiredAccess => 983103 KeyHandle => 0x0000014c ObjectAttributes => Keyboard Layout\Preload |
SUCCESS | 0x00000000 | |
| 09:15:14,695 | 444 | NtQueryValueKey |
Information => 0\x000\x000\x000\x000\x004\x000\x009\x00\x00\x00 KeyHandle => 0x0000014c ValueName => 1 Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:14,695 | 444 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000140 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\00000409 |
SUCCESS | 0x00000000 | |
| 09:15:14,695 | 444 | NtQueryValueKey |
Information => K\x00B\x00D\x00U\x00S\x00.\x00D\x00L\x00L\x00\x00\x00 KeyHandle => 0x00000140 ValueName => Layout File Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:14,695 | 444 | NtQueryValueKey |
KeyHandle => 0x00000140 ValueName => Attributes |
FAILURE | 3221225524 | |
| 09:15:14,735 | 348 | LdrLoadDll |
Flags => 23460056 BaseAddress => 0x5ad70000 FileName => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,735 | 348 | IsDebuggerPresent | FAILURE | 0x00000000 | ||
| 09:15:14,735 | 348 | LdrLoadDll |
Flags => 23459876 BaseAddress => 0x5ad70000 FileName => uxtheme.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,735 | 444 | LdrLoadDll |
Flags => 1240992 BaseAddress => 0x5fff0000 FileName => KBDUS.DLL |
SUCCESS | 0x00000000 | |
| 09:15:14,745 | 444 | LdrGetProcedureAddress |
Ordinal => 3 FunctionName => FunctionAddress => 0x00000003 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:15:14,745 | 444 | LdrGetProcedureAddress |
Ordinal => 5 FunctionName => FunctionAddress => 0x00000005 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:15:14,745 | 444 | LdrGetProcedureAddress |
Ordinal => 6 FunctionName => FunctionAddress => 0x00000006 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:15:14,745 | 444 | LdrGetProcedureAddress |
Ordinal => 1 FunctionName => FunctionAddress => 0x5fff1a5a ModuleHandle => 0x5fff0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,745 | 444 | LdrGetProcedureAddress |
Ordinal => 2 FunctionName => FunctionAddress => 0x00000002 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:15:14,745 | 348 | GetSystemMetrics |
SystemMetricIndex => 31 |
SUCCESS | 0x00000019 | |
| 09:15:14,745 | 348 | ZwMapViewOfSection |
SectionOffset => 0x0165f70c SectionHandle => 0x00000154 ProcessHandle => 0xffffffff BaseAddress => 0x016f0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,745 | 444 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\KBDUS.DLL DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:15:14,745 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => adialhk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => acpiz.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => avgrsstx.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => babylonchromepi.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => babylo~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => btkeyind.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cmcsyshk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cmsetac.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cooliris.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => dockshellhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => docksh~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => easyhook32.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => easyho~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => googledesktopnetwork3.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => google~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => fwhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookprocesscreation.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookpr~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookterminateapis.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookte~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookprintapis.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookpr~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => imon.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => ioloHL.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => kloehk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lawenforcer.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lawenf~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => libdivx.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lvprcinj01.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lvprci~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => madchook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => mdnsnsp.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => moonsysh.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => mpk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npdivx32.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npggNT.des |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npggNT.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => oawatch.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10513.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10514.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10515.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10516.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10517.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10518.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10519.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10520.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10521.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10522.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10523.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavlsphook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavlsp~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavshook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavshookwow.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavsho~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctavhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctavh~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctgmhk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => prntrack.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => protector.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => protec~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => radhslib.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => radprlib.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rapportnikko.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rappor~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rlhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rooksdol.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rpchromebrowserrecordhelper.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rpchro~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => r3hook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sahook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sbrige.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sc2hook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sdhook32.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sguard.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => smum32.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => smumhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => ssldivx.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => syncor11.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => systools.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,755 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => tfwah.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,775 | 348 | GetSystemMetrics |
SystemMetricIndex => 31 |
SUCCESS | 0x00000019 | 1 time |
| 09:15:14,775 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => wblind.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,775 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => wbhelp.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,775 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => winstylerthemehelper.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,775 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => winsty~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:14,775 | 444 | RegOpenKeyExW |
Handle => 0x00000164 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegQueryValueExW |
Handle => 0x00000164 DataLength => 4 ValueName => bUseWhitelistConfigFile Type => 1243632 |
FAILURE | 0x00000002 | |
| 09:15:14,775 | 444 | RegCloseKey |
Handle => 0x00000164 |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegOpenKeyExW |
Handle => 0x00000164 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegQueryValueExW |
Handle => 0x00000164 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegCloseKey |
Handle => 0x00000164 |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegOpenKeyExW |
Handle => 0x00000168 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegQueryValueExW |
Handle => 0x00000168 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x001ed1a8 | 1 time |
| 09:15:14,775 | 444 | RegOpenKeyExW |
Handle => 0x00000168 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegQueryValueExW |
Handle => 0x00000168 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:14,775 | 444 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x001ed1a8 | 2 times |
| 09:15:14,775 | 444 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x001ed1a8 | |
| 09:15:14,775 | 444 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x001ed1a8 | |
| 09:15:14,775 | 444 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x001ed1a8 | |
| 09:15:14,775 | 444 | RegCreateKeyExW |
Handle => 0x00000168 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegQueryValueExW |
Handle => 0x00000168 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCreateKeyExW |
Handle => 0x00000168 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegSetValueExW |
Handle => 0x00000168 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | 5 times |
| 09:15:14,785 | 444 | RegCreateKeyExW |
Handle => 0x00000168 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegQueryValueExW |
Handle => 0x00000168 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCreateKeyExW |
Handle => 0x00000168 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegSetValueExW |
Handle => 0x00000168 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | 3 times |
| 09:15:14,785 | 444 | RegCreateKeyExW |
Handle => 0x00000168 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegQueryValueExW |
Handle => 0x00000168 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCreateKeyExW |
Handle => 0x00000168 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegSetValueExW |
Handle => 0x00000168 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:14,785 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | 7 times |
| 09:15:14,795 | 444 | CreateDirectoryExW |
DirectoryName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx |
SUCCESS | 0x00000001 | |
| 09:15:14,795 | 444 | NtCreateFile |
ShareAccess => 3 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:14,795 | 444 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,795 | 444 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,805 | 444 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,805 | 444 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,805 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHCreateDirectoryExW FunctionAddress => 0x7ca0b24a ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,805 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
FAILURE | 0x00000000 | |
| 09:15:14,805 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:15:14,805 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:15:14,805 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data |
FAILURE | 0x00000000 | |
| 09:15:14,835 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00000001 | |
| 09:15:14,835 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:14,835 | 444 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:14,835 | 444 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoNetHood Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:15:14,835 | 444 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:14,835 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:14,835 | 444 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:14,835 | 444 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoPropertiesMyComputer Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:15:14,835 | 444 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:14,835 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:14,835 | 444 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:14,835 | 444 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoInternetIcon Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:15:14,835 | 444 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:14,835 | 444 | LdrGetProcedureAddress |
Ordinal => 236 FunctionName => FunctionAddress => 0x773e1798 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,835 | 444 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => OLE32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | LdrLoadDll |
Flags => 1239076 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetMalloc FunctionAddress => 0x774fdd08 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoCommonGroups Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CreateBindCtx FunctionAddress => 0x774fe54c ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D} |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoControlPanel Type => 1238272 |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000170 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegQueryValueExW |
Handle => 0x00000170 DataLength => 4 ValueName => NoSetFolders Type => 1238272 |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegOpenKeyExA |
Handle => 0x00000176 Registry => 0x80000000 SubKey => CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegQueryValueExW |
Handle => 0x00000176 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00S\x00H\x00E\x00L\x00L\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | LdrLoadDll |
Flags => 1238852 BaseAddress => 0x7c9c0000 FileName => C:\WINDOWS\system32\SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegQueryValueExW |
Handle => 0x0000017a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,845 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegOpenKeyExW |
Handle => 0x00000174 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | RegQueryValueExW |
Handle => 0x00000174 DataLength => 4 ValueName => AllowFileCLSIDJunctions Type => 1237108 |
FAILURE | 0x00000002 | |
| 09:15:14,845 | 444 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,845 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,855 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,855 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00000001 | |
| 09:15:14,855 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,855 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,865 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,865 | 444 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,865 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,865 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,865 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,865 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000178 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,865 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,865 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,875 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00000001 | |
| 09:15:14,875 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,875 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,875 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,875 | 444 | RegQueryValueExW |
Handle => 0x0000017a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,875 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,875 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,875 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,875 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,875 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,885 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,885 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,885 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,895 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,895 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,895 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
FAILURE | 0x00000000 | |
| 09:15:14,895 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:15:14,895 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:15:14,895 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings |
FAILURE | 0x00000000 | |
| 09:15:14,895 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data |
FAILURE | 0x00000000 | |
| 09:15:14,905 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00000001 | |
| 09:15:14,905 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,905 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,905 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,905 | 444 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,905 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,905 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,905 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,905 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000178 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,905 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,905 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,915 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00000001 | |
| 09:15:14,915 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,915 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,915 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,915 | 444 | RegQueryValueExW |
Handle => 0x0000017a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,915 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,915 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,915 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,915 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,915 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,925 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,925 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00000001 | |
| 09:15:14,925 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,925 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,925 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,925 | 444 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,925 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,925 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,925 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,925 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000178 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,935 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,935 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,945 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,945 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,945 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,945 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,945 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x00000001 | |
| 09:15:14,945 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,945 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,945 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,945 | 444 | RegQueryValueExW |
Handle => 0x0000017a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,945 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,945 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,945 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,945 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,945 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,955 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,955 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,955 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Linguistics |
SUCCESS | 0x00000001 | |
| 09:15:14,955 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,955 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000178 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,955 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,965 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,965 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Microsoft\Speech |
SUCCESS | 0x00000001 | |
| 09:15:14,965 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | RegQueryValueExW |
Handle => 0x0000017a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,965 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,965 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,975 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,975 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,975 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\Speech |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,985 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\LogTransport2 |
SUCCESS | 0x00000001 | |
| 09:15:14,985 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:14,985 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:14,985 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:14,985 | 444 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:14,985 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:14,985 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:14,985 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:14,985 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000178 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:14,985 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,985 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:14,995 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:14,995 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ed9a8 | |
| 09:15:15,316 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Headlights |
SUCCESS | 0x00000001 | |
| 09:15:15,316 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:15,316 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:15,316 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:15,316 | 444 | RegQueryValueExW |
Handle => 0x0000017a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:15,316 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:15,316 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:15,316 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:15,326 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:15,326 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:15,326 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:15,326 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:15,326 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ed9a8 | |
| 09:15:15,326 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache |
FAILURE | 0x00000000 | |
| 09:15:15,336 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:15:15,336 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:15:15,336 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data |
FAILURE | 0x00000000 | |
| 09:15:15,336 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe |
FAILURE | 0x00000000 | |
| 09:15:15,336 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player |
SUCCESS | 0x00000001 | |
| 09:15:15,336 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | RegQueryValueExW |
Handle => 0x00000176 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | RegEnumKeyW |
Handle => 0x0000017a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:15,336 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000178 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:15,336 | 444 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache |
SUCCESS | 0x00000001 | |
| 09:15:15,336 | 444 | RegOpenKeyExW |
Handle => 0x00000176 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | RegOpenKeyExW |
Handle => 0x0000017a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | RegQueryValueExW |
Handle => 0x0000017a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | RegCloseKey |
Handle => 0x0000017a |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | RegEnumKeyW |
Handle => 0x00000176 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:15,346 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000174 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000174 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000178 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:15,346 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:15,346 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001ed9a8 | |
| 09:15:15,346 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | 3 times |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegQueryValueExW |
Handle => 0x00000178 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00M\x00y\x00 \x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Personal |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegSetValueExW |
Handle => 0x00000178 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00M\x00y\x00 \x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Personal Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001ed9a8 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtQueryObject FunctionAddress => 0x7c90d870 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000176 Access => 33554432 Registry => 0x80000000 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000176 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000174 Access => 33554432 Registry => 0x80000002 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000174 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000003 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000017c Access => 33554432 Registry => 0x80000005 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000017c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000180 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Adobe Acrobat\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000017c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000017c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000017c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000017c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000017c Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000184 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000184 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000184 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000184 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000188 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000184 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000184 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000184 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x00000184 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x00000184 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\CommonFiles\Usage\Reader 11 |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,356 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,366 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,366 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,366 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,366 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,366 | 444 | RegCreateKeyExW |
Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:15,366 | 444 | RegCloseKey |
Handle => 0x0000018c |
SUCCESS | 0x00000000 | |
| 09:15:15,366 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Justsystem\ATOK\Setup\Folder |
FAILURE | 0x00000002 | |
| 09:15:15,366 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 0 ValueName => Atok23 Type => 1 |
FAILURE | 0x00000006 | |
| 09:15:15,366 | 444 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Justsystem\ATOK\Setup\Folder |
FAILURE | 0x00000002 | |
| 09:15:15,366 | 444 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 0 ValueName => Atok24 Type => 1 |
FAILURE | 0x00000006 | |
| 09:15:15,366 | 444 | NtCreateMutant |
Handle => 0x0000018c InitialOwner => 0 MutexName => {100184D2-BDC3-477a-B8D3-65548B67914C}_440 |
SUCCESS | 0x00000000 | |
| 09:15:15,376 | 444 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeChangeNotifyPrivilege |
SUCCESS | 0x00000001 | 19 times |
| 09:15:15,526 | 444 | FindWindowW |
ClassName => 0 WindowName => _AcroAppTimer |
FAILURE | 0x00000000 | |
| 09:15:15,526 | 444 | FindWindowW |
ClassName => 0 WindowName => SafeNet Borderless Single Sign On..... |
FAILURE | 0x00000000 | |
| 09:15:15,526 | 444 | LdrLoadDll |
Flags => 1241956 BaseAddress => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,526 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CreateProcessInternalWSecure FunctionAddress => 0x7c8806f8 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,556 | 444 | CreateProcessInternalW |
ApplicationName => C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe ProcessId => 1316 CommandLine => "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe" --channel=440.0.1618217971 --type=renderer "C:\DOCUME~1\TDW\LOCALS~1\Temp\aug14bcl-b4.pdf" ThreadHandle => 0x000001b8 ProcessHandle => 0x000001b4 ThreadId => 1312 CreationFlags => 0x0100040c |
SUCCESS | 0x00000001 | |
| 09:15:15,566 | 444 | NtGetContextThread |
ThreadHandle => 0x000001b8 |
SUCCESS | 0x00000000 | |
| 09:15:15,566 | 444 | WriteProcessMemory |
Buffer => \x04\x00\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053e3c0 |
SUCCESS | 0x00000001 | |
| 09:15:15,566 | 444 | WriteProcessMemory |
Buffer => \x08\x00\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053e3c4 |
SUCCESS | 0x00000001 | |
| 09:15:15,566 | 444 | WriteProcessMemory |
Buffer => \x05\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053f428 |
SUCCESS | 0x00000001 | |
| 09:15:15,576 | 444 | WriteProcessMemory |
Buffer => \x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053e3b3 |
SUCCESS | 0x00000001 | |
| 09:15:15,576 | 444 | WriteProcessMemory |
Buffer => \x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053e3b2 |
SUCCESS | 0x00000001 | |
| 09:15:15,576 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,576 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtOpenKeyEx FunctionAddress => 0x00502a70 ModuleHandle => 0x7c900000 |
FAILURE | 3221225785 | |
| 09:15:15,576 | 444 | RegOpenKeyExW |
Handle => 0x000001a8 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:15,576 | 444 | RegQueryValueExW |
Handle => 0x000001a8 DataLength => 4 ValueName => bDisableCryptBroker Type => 1242944 |
FAILURE | 0x00000002 | |
| 09:15:15,586 | 444 | RegCloseKey |
Handle => 0x000001a8 |
SUCCESS | 0x00000000 | |
| 09:15:15,586 | 444 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => dgapi.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:15,586 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,586 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtAddAtomEx FunctionAddress => 0x0051c138 ModuleHandle => 0x7c900000 |
FAILURE | 3221225785 | |
| 09:15:15,596 | 444 | WriteProcessMemory |
Buffer => \x0c\x00\x00\x00\x00\x00\x00\x00\xa8\x00\x00\x00(\x00\x00\x00\x04\x00\x00\x00\x00\x00k\x00e\x00r\x00n\x00e\x00l\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 \x00\x00\x00\x03\x00\x00\x00\x0f\x00\x00\x00\xd0FF\x00CreateProcessW\x00\x00 \x00\x00\x00\x03\x00\x00\x00\x10\x00\x00\x00PHF\x00CreateProcessA\x00\x00 \x00\x00\x00\x02\x00\x00\x00^\x00\x00\x000vN\x00MoveFileExW\x00\x00\x00\x00\x00 \x00\x00\x00\x03\x00\x00\x00!\x01\x00\x00@\x9aA\x00CreateThread\x00\x00\x00\x00T\x04\x00\x00(\x00\x00\x00\x1a\x00\x00\x00\x00\x00C\x00r\x00y\x00p\x00t\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00\x00\x00$\x00\x00\x00\x02\x00\x00\x00)\x00\x00\x00P\x9fN\x00CryptProtectData\x00\x00\x00\x00(\x00\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x009c0000 |
SUCCESS | 0x00000001 | |
| 09:15:15,596 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,596 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,606 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,636 | 444 | ReadProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2,\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d090 |
SUCCESS | 0x00000001 | |
| 09:15:15,636 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,636 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,636 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,636 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,646 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,646 | 444 | WriteProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2,\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xe0\x9d\x00\xc7D$\x04\x10+A\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de010 |
SUCCESS | 0x00000001 | |
| 09:15:15,646 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d090 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,646 | 444 | WriteProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba(\xe0\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d090 |
SUCCESS | 0x00000001 | |
| 09:15:15,646 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d090 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,646 | 444 | ReadProcessMemory |
Buffer => \xb8t\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x18\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d580 |
SUCCESS | 0x00000001 | |
| 09:15:15,646 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,646 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,646 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,656 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,656 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,656 | 444 | WriteProcessMemory |
Buffer => \xb8t\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x18\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xe0\x9d\x00\xc7D$\x04P\x10@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de050 |
SUCCESS | 0x00000001 | |
| 09:15:15,656 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d580 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,656 | 444 | WriteProcessMemory |
Buffer => \xb8t\x00\x00\x00\xbah\xe0\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d580 |
SUCCESS | 0x00000001 | |
| 09:15:15,656 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d580 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,656 | 444 | ReadProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d6f0 |
SUCCESS | 0x00000001 | |
| 09:15:15,656 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,656 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,656 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,656 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,666 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,666 | 444 | WriteProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xe0\x9d\x00\xc7D$\x04\xe0G@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de090 |
SUCCESS | 0x00000001 | |
| 09:15:15,666 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d6f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,666 | 444 | WriteProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\xa8\xe0\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d6f0 |
SUCCESS | 0x00000001 | |
| 09:15:15,666 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d6f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,666 | 444 | ReadProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d790 |
SUCCESS | 0x00000001 | |
| 09:15:15,666 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,666 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,666 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,676 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,676 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,676 | 444 | WriteProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xe0\x9d\x00\xc7D$\x04\x00\xedA\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de0d0 |
SUCCESS | 0x00000001 | |
| 09:15:15,676 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d790 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,676 | 444 | WriteProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\xe8\xe0\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d790 |
SUCCESS | 0x00000001 | |
| 09:15:15,676 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d790 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,676 | 444 | ReadProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90dc40 |
SUCCESS | 0x00000001 | |
| 09:15:15,676 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,676 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,676 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,686 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,686 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,686 | 444 | WriteProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xe1\x9d\x00\xc7D$\x04 \xbdA\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de110 |
SUCCESS | 0x00000001 | |
| 09:15:15,686 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90dc40 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,686 | 444 | WriteProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba(\xe1\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90dc40 |
SUCCESS | 0x00000001 | |
| 09:15:15,686 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90dc40 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,686 | 444 | ReadProcessMemory |
Buffer => \xb8#\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d070 |
SUCCESS | 0x00000001 | |
| 09:15:15,686 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,686 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,686 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,696 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,696 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,696 | 444 | WriteProcessMemory |
Buffer => \xb8#\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xe1\x9d\x00\xc7D$\x04pL@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de150 |
SUCCESS | 0x00000001 | |
| 09:15:15,696 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d070 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,696 | 444 | WriteProcessMemory |
Buffer => \xb8#\x00\x00\x00\xbah\xe1\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d070 |
SUCCESS | 0x00000001 | |
| 09:15:15,696 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d070 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,696 | 444 | ReadProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d560 |
SUCCESS | 0x00000001 | |
| 09:15:15,706 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,706 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,706 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,706 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,706 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,706 | 444 | WriteProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xe1\x9d\x00\xc7D$\x04\xd0KA\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de190 |
SUCCESS | 0x00000001 | |
| 09:15:15,706 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d560 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,706 | 444 | WriteProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\xa8\xe1\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d560 |
SUCCESS | 0x00000001 | |
| 09:15:15,706 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d560 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,706 | 444 | ReadProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d0d0 |
SUCCESS | 0x00000001 | |
| 09:15:15,706 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,706 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,716 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,716 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,716 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,716 | 444 | WriteProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xe1\x9d\x00\xc7D$\x04`\x9dA\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de1d0 |
SUCCESS | 0x00000001 | |
| 09:15:15,716 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d0d0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,716 | 444 | WriteProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\xe8\xe1\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d0d0 |
SUCCESS | 0x00000001 | |
| 09:15:15,716 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d0d0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,716 | 444 | ReadProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d5b0 |
SUCCESS | 0x00000001 | |
| 09:15:15,716 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,716 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,716 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,726 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,726 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,726 | 444 | WriteProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xe2\x9d\x00\xc7D$\x04\x00\x10@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de210 |
SUCCESS | 0x00000001 | |
| 09:15:15,726 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d5b0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,726 | 444 | WriteProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba(\xe2\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d5b0 |
SUCCESS | 0x00000001 | |
| 09:15:15,726 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d5b0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,736 | 444 | ReadProcessMemory |
Buffer => \xb8x\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d5c0 |
SUCCESS | 0x00000001 | |
| 09:15:15,736 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,736 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,736 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,736 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,736 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,736 | 444 | WriteProcessMemory |
Buffer => \xb8x\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xe2\x9d\x00\xc7D$\x04\x00NA\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de250 |
SUCCESS | 0x00000001 | |
| 09:15:15,736 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d5c0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,736 | 444 | WriteProcessMemory |
Buffer => \xb8x\x00\x00\x00\xbah\xe2\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d5c0 |
SUCCESS | 0x00000001 | |
| 09:15:15,736 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d5c0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,746 | 444 | ReadProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d0f0 |
SUCCESS | 0x00000001 | |
| 09:15:15,746 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,746 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,746 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,746 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,746 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,746 | 444 | WriteProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xe2\x9d\x00\xc7D$\x04@K@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de290 |
SUCCESS | 0x00000001 | |
| 09:15:15,746 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d0f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,746 | 444 | WriteProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\xa8\xe2\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d0f0 |
SUCCESS | 0x00000001 | |
| 09:15:15,746 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d0f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,746 | 444 | ReadProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d160 |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,756 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,756 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,756 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,756 | 444 | WriteProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xe2\x9d\x00\xc7D$\x04\xa0@@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de2d0 |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d160 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | WriteProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\xe8\xe2\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d160 |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d160 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | ReadProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d610 |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,756 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,756 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,756 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,756 | 444 | WriteProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xe3\x9d\x00\xc7D$\x04P\x13@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de310 |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d610 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | WriteProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba(\xe3\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d610 |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d610 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,756 | 444 | ReadProcessMemory |
Buffer => \xb8A\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d250 |
SUCCESS | 0x00000001 | |
| 09:15:15,766 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,766 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,766 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,766 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,766 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,766 | 444 | WriteProcessMemory |
Buffer => \xb8A\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xe3\x9d\x00\xc7D$\x04\x10\x8dF\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de350 |
SUCCESS | 0x00000001 | |
| 09:15:15,766 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d250 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,766 | 444 | WriteProcessMemory |
Buffer => \xb8A\x00\x00\x00\xbah\xe3\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d250 |
SUCCESS | 0x00000001 | |
| 09:15:15,766 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d250 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,766 | 444 | ReadProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d640 |
SUCCESS | 0x00000001 | |
| 09:15:15,766 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,776 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,776 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,776 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,776 | 444 | WriteProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xe3\x9d\x00\xc7D$\x04`EF\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de390 |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d640 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | WriteProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\xa8\xe3\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d640 |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d640 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | ReadProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d5e0 |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,776 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,776 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,776 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,776 | 444 | WriteProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xe3\x9d\x00\xc7D$\x040\xb1A\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de3d0 |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d5e0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | WriteProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\xe8\xe3\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d5e0 |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d5e0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,776 | 444 | ReadProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d5f0 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | WriteProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xe4\x9d\x00\xc7D$\x040B@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de410 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d5f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | WriteProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba(\xe4\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d5f0 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d5f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | ReadProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90dc90 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | WriteProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xe4\x9d\x00\xc7D$\x04PJA\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de450 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90dc90 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | WriteProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xbah\xe4\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90dc90 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90dc90 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | ReadProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d650 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | WriteProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xe4\x9d\x00\xc7D$\x04\xd05A\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de490 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d650 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | WriteProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\xa8\xe4\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d650 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d650 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | ReadProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d600 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,786 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,786 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xe4\x9d\x00\xc7D$\x04\x00\x99A\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de4d0 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d600 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\xe8\xe4\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d600 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d600 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d660 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xe5\x9d\x00\xc7D$\x04\xf0C@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de510 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d660 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba(\xe5\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d660 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d660 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90cec0 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xe5\x9d\x00\xc7D$\x04\x80#A\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de550 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90cec0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xbah\xe5\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90cec0 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90cec0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d300 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xe5\x9d\x00\xc7D$\x04\xa0\xf4A\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de590 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d300 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\xa8\xe5\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d300 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d300 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x04\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d200 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x04\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\xe5\x9d\x00\xc7D$\x04\x80\x7fN\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de5d0 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d200 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | WriteProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\xe8\xe5\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d200 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d200 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d7a0 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,796 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\xe6\x9d\x00\xc7D$\x04p\x80N\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de610 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d7a0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba(\xe6\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d7a0 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d7a0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | ReadProcessMemory |
Buffer => \xb8l\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2(\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d500 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => \xb8l\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2(\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\xe6\x9d\x00\xc7D$\x04\x80\x14@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de650 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90d500 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => \xb8l\x00\x00\x00\xbah\xe6\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90d500 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90d500 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | ReadProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90def0 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\xe6\x9d\x00\xc7D$\x04pI@\x00Z\xc3 ProcessHandle => 0x000001b4 BaseAddress => 0x009de690 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001b4 Address => 0x7c90def0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\xa8\xe6\x9d\x00\xff\xe2 ProcessHandle => 0x000001b4 BaseAddress => 0x7c90def0 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x7c90def0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => \x10\x07\x00\x00\xd0\x06\x00\x00\x8c\xf7\x12\x00\x1b\x00\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x009de000 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001b4 Address => 0x009de000 Size => 0x00000710 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => P\xe6\x9d\x00\x90\xe6\x9d\x00P\xe4\x9d\x00\x90\xe4\x9d\x00\x10\xe5\x9d\x00\x90\xe3\x9d\x00\xd0\xe3\x9d\x00\x10\xe4\x9d\x00\xd0\xe4\x9d\x00\x10\xe0\x9d\x00P\xe0\x9d\x00\x90\xe0\x9d\x00\xd0\xe0\x9d\x00\x10\xe1\x9d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\xe1\x9d\x00\x10\xe2\x9d\x00\x00\x00\x00\x00P\xe1\x9d\x00\x90\xe1\x9d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P\xe2\x9d\x00\x90\xe2\x9d\x00\xd0\xe2\x9d\x00\x10\xe3\x9d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053f598 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | WriteProcessMemory |
Buffer => \x00\x00\x9c\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053fa74 |
SUCCESS | 0x00000001 | |
| 09:15:15,806 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,806 | 444 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:15,816 | 444 | WriteProcessMemory |
Buffer => P\xcf\x90|\xd0\xcf\x90|\x80\xd2\x90|p\xd3\x90|\x00\xd5\x90|\xd0\xd6\x90|\xe0\xd7\x90|p\xd8\x90|\xb0\xd8\x90|`\xd9\x90|\xf0\xde\x90|\xa4\x00\x91|\x1b\xeb\x90|\x88y\x91|b\\x92|j\xdf\x92|\xced\x92|
\xff\x90|}\x98\x91|E&\x90|*\xfe\x90|\xf0\xd7\x90|\x90\xd0\x90|@\xdc\x90|\xf0\xd6\x90|\x90\xd7\x90|\xb0\xd5\x90|\xd0\xd0\x90|P\xd2\x90|\xf0\xd0\x90|\xc0\xd5\x90|`\xd1\x90|\x10\xd6\x90|\xc0\xce\x90|\x00\xd3\x90|\x00\xd2\x90|\xa0\xd7\x90|@\xd6\x90|\xe0\xd5\x90|\xf0\xd5\x90|\x00\xd6\x90| ProcessHandle => 0x000001b4 BaseAddress => 0x0053f4b8 |
SUCCESS | 0x00000001 | |
| 09:15:15,816 | 444 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x000001a8 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:15,816 | 444 | ZwMapViewOfSection |
SectionOffset => 0x0012f7b4 SectionHandle => 0x000001a8 ProcessHandle => 0xffffffff BaseAddress => 0x019c0000 |
SUCCESS | 0x00000000 | |
| 09:15:15,816 | 444 | WriteProcessMemory |
Buffer => \x0c\x00\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053f4ac |
SUCCESS | 0x00000001 | |
| 09:15:15,816 | 444 | WriteProcessMemory |
Buffer => \x00\x00 \x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053f560 |
SUCCESS | 0x00000001 | |
| 09:15:15,816 | 444 | WriteProcessMemory |
Buffer => \x00\x00\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053f564 |
SUCCESS | 0x00000001 | |
| 09:15:15,816 | 444 | NtCreateMutant |
Handle => 0x0000019c InitialOwner => 1 MutexName => |
SUCCESS | 0x00000000 | |
| 09:15:15,836 | 444 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c927ebb CreationFlags => 4 |
SUCCESS | 0x000001cc | |
| 09:15:15,836 | 444 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001cc |
SUCCESS | 0x00000000 | |
| 09:15:15,846 | 1516 | NtDelayExecution |
Milliseconds => 1566804069 |
SUCCESS | 0x00000000 | |
| 09:15:15,846 | 444 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x000001d4 | |
| 09:15:15,846 | 444 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001d4 |
SUCCESS | 0x00000000 | |
| 09:15:15,856 | 444 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c929b6f CreationFlags => 4 |
SUCCESS | 0x000001e0 | |
| 09:15:15,856 | 444 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001e0 |
SUCCESS | 0x00000000 | |
| 09:15:15,856 | 444 | WriteProcessMemory |
Buffer => \x04\x00\x00\x00 ProcessHandle => 0x000001b4 BaseAddress => 0x0053aae8 |
SUCCESS | 0x00000001 | |
| 09:15:15,856 | 444 | NtOpenFile |
ShareAccess => 3 FileName => C:\WINDOWS\system32 DesiredAccess => 0x00100020 FileHandle => 0x00000254 |
SUCCESS | 0x00000000 | |
| 09:15:15,856 | 444 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001a0 |
SUCCESS | 0x00000000 | |
| 09:15:16,968 | 1380 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x000001a0 | |
| 09:15:16,978 | 1380 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001a0 |
SUCCESS | 0x00000000 | |
| 09:15:16,988 | 1660 | RegOpenKeyExW |
Handle => 0x000001a0 Registry => 0x80000002 SubKey => System |
SUCCESS | 0x00000000 | |
| 09:15:16,988 | 1660 | RegCloseKey |
Handle => 0x000001a0 |
SUCCESS | 0x00000000 | |
| 09:15:16,988 | 1660 | RegCreateKeyExW |
Handle => 0x000001a0 Access => 33554432 Registry => 0x80000002 Class => SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:15:16,988 | 1660 | RegCloseKey |
Handle => 0x000001a0 |
SUCCESS | 0x00000000 | |
| 09:15:16,998 | 1660 | RegDeleteKeyW |
Handle => 0x80000002 SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:15:17,148 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:17,148 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RtlInitUnicodeString FunctionAddress => 0x7c901295 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:17,148 | 1660 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000000 ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated |
FAILURE | 3221225524 | |
| 09:15:17,158 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated DesiredAccess => 3758293023 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,158 | 1660 | NtOpenKey |
DesiredAccess => 196639 KeyHandle => 0x00000268 ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated |
SUCCESS | 0x00000000 | |
| 09:15:17,158 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated DesiredAccess => 196639 KeyHandle => 0x00000268 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,168 | 1660 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000000 ObjectAttributes => Language |
FAILURE | 3221225524 | |
| 09:15:17,168 | 1660 | NtCreateKey |
ObjectAttributes => Language DesiredAccess => 3758293023 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,168 | 1660 | NtCreateKey |
ObjectAttributes => UseMUI DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,238 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Language\current DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,278 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Originals DesiredAccess => 2 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:18,620 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | 1 time |
| 09:15:18,630 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:18,630 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,630 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:18,630 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:18,630 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:18,630 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,630 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:18,640 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:18,640 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:18,640 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:18,640 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,640 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:18,640 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:18,650 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:18,650 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:18,650 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,650 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:18,650 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:18,650 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:18,650 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:18,650 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,351 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:19,351 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:19,361 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,361 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:19,361 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:19,361 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,361 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:19,371 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:19,371 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:21,344 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ExitSection DesiredAccess => 2 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:21,685 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:21,685 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:21,685 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:21,695 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:21,695 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x002059a8 | |
| 09:15:21,695 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:21,695 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:21,695 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x002059a8 | |
| 09:15:21,715 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color\ACECache11.lst DesiredAccess => 0x00120196 CreateDisposition => 5 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:21,715 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:21,715 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000268 FileInformation => $\x19T\x8a\xa2\xcf\x01 $\x19T\x8a\xa2\xcf\x01 $\x19T\x8a\xa2\xcf\x01 $\x19T\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00;L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x96\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:21,845 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | 1 time |
| 09:15:21,855 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:21,855 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:21,855 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:21,855 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:21,855 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:21,865 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:21,865 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:21,865 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:21,865 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:21,865 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:21,875 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:21,875 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:21,875 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:21,875 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:21,875 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:21,875 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:21,875 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:22,055 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,065 | 1660 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,215 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,225 | 1660 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,255 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,255 | 1660 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,416 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,416 | 1660 | NtCreateKey |
ObjectAttributes => cInstallData DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,416 | 1660 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_extensions_2E_files_5F_11_2E_0_2E_7_2E_0 DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,456 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,476 | 1660 | NtCreateKey |
ObjectAttributes => cInstallData DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,476 | 1660 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_extensions_2E_files_5F_11_2E_0_2E_7_2E_0 DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,476 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,476 | 1660 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,556 | 1660 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x0000026c ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:22,556 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com DesiredAccess => 65547 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,556 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com.v2 DesiredAccess => 65547 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,556 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 DesiredAccess => 65547 KeyHandle => 0x0000026c Class => |
SUCCESS | 0x00000000 | |
| 09:15:22,636 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:22,636 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:22,636 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:22,636 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:22,636 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:22,636 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:22,646 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:22,646 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:22,646 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:22,646 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:22,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:22,656 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:22,656 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:22,656 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:22,656 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:22,666 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:22,666 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:22,666 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002059a8 | |
| 09:15:22,666 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002059a8 | |
| 09:15:22,666 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002059a8 | |
| 09:15:22,666 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002059a8 | |
| 09:15:22,666 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000268 |
SUCCESS | 0x00000000 | |
| 09:15:22,666 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000026c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,361 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000026c ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:26,361 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x0000026c SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:15:26,361 | 1660 | RegOpenKeyExA |
Handle => 0x0000026c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | RegQueryValueExA |
Handle => 0x0000026c DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | RegQueryValueExA |
Handle => 0x0000026c Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | RegCloseKey |
Handle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | RegOpenKeyExA |
Handle => 0x0000026c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | RegQueryValueExA |
Handle => 0x0000026c Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | RegQueryValueExA |
Handle => 0x0000026c DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | RegQueryValueExA |
Handle => 0x0000026c Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rsaenh.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:26,371 | 1660 | NtOpenKey |
DesiredAccess => 1 KeyHandle => 0x00000270 ObjectAttributes => \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | NtQueryValueKey |
KeyHandle => 0x00000270 ValueName => SafeProcessSearchMode |
FAILURE | 3221225524 | |
| 09:15:26,371 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => \x000\x03\x00\x00\x00\x00\x00\x00.\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000274 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,371 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbf864 SectionHandle => 0x00000274 ProcessHandle => 0xffffffff BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:26,381 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,381 | 1660 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000274 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,391 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbf8c8 SectionHandle => 0x00000274 ProcessHandle => 0xffffffff BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:26,391 | 1660 | NtReadFile |
Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode.
$\x00\x00\x00\x00\x00\x00\x00\x14_\xd9\x13P>\xb7@P>\xb7@P>\xb7@w\xf8\xda@H>\xb7@\x931\xb8@Y>\xb7@P>\xb6@\xc5>\xb7@\x931\xea@[>\xb7@\x931\xeb@Q>\xb7@\x931\xe9@Q>\xb7@\x931\xd7@Q>\xb7@\x931\xe8@\x7f>\xb7@\x931\xed@Q>\xb7@RichP>\xb7@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,391 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => P\x01\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtSetInformationFile |
FileHandle => 0x00000270 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \x03\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x000\xea\x02\x00\xbb\x02\x00\x00\xc4\xdd\x02\x00x\x00\x00\x00\x000\x03\x00P\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00\xc8\x10\x00\x00@\x12\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10e\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x008\x02\x00\x00\xbc\xdb\x02\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.text\x00\x00\x00\xeb\xdc\x02\x00\x00\x10\x00\x00\x00\xde\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00`.data\x00\x00\x00 0\x00\x00\x00\xf0\x02\x00\x00*\x00\x00\x00\xe2\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\xc0.rsrc\x00\x00\x00P\x0c\x00\x00\x000\x03\x00\x00\x0e\x00\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \x00\x04\x00\x08\x00\x00\x00\x08\x00\x04\x01\x00 \x04\x01\x08\x00\x00\x00\x00 \x04\x01\x00\x00\x00\x00\x08\x00\x04\x00\x00 \x00\x01\x00 \x04\x00\x08\x00\x04\x00\x00\x00\x00\x00\x00 \x04\x01\x08 \x00\x01\x08\x00\x04\x01\x08 \x04\x00\x00\x00\x00\x01\x00\x00\x04\x01\x00 \x00\x01\x08\x00\x04\x00\x08 \x04\x00\x00 \x00\x00\x00 \x04\x01\x00\x00\x00\x01\x08 \x00\x00\x08@\x00\x00\x80@\x00 \x00\x00\x00\x00\x00\x00 \x80@\x00 \x00\x00 \x00\x00@ \x00\x80\x00\x00 \x00@ \x00\x00@ \x80\x00 \x00\x00\x00\x00\x80\x00 \x00\x80@\x00\x00\x80\x00\x00 \x80@ \x00\x00\x00 \x00@ \x00\x80@\x00 \x80\x00\x00\x00\x00\x00 \x00\x00@\x00\x00\x00\x00 \x80@\x00 \x80@ \x80\x00\x00 \x80\x00\x00\x00\x80@ \x00\x00@\x00\x00\x00\x00 \x00@ \x00\x00 \x00\x80@ \x00\x00\x00\x00\x00\x80\x00 \x00\x80@ \x00\x00 \x80@\x00 \x00\x00\x00\x00\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => '\x9e\x9e\xb9\xd9\xe1\xe18\xeb\xf8\xf8\x13+\x98\x98\xb3"\x11\x113\xd2ii\xbb\xa9\xd9\xd9p\x07\x8e\x8e\x893\x94\x94\xa7-\x9b\x9b\xb6<\x1e\x1e"\x15\x87\x87\x92\xc9\xe9\xe9 \x87\xce\xceI\xaaUU\xffP((x\xa5\xdf\xdfz\x03\x8c\x8c\x8fY\xa1\xa1\xf8 \x89\x89\x80\x1a
\x17e\xbf\xbf\xda\xd7\xe6\xe61\x84BB\xc6\xd0hh\xb8\x82AA\xc3)\x99\x99\xb0Z--w\x1e\x0f\x0f\x11{\xb0\xb0\xcb\xa8TT\xfcm\xbb\xbb\xd6,\x16\x16:\xa5\xc6cc\x84\xf8||\x99\xeeww\x8d\xf6{{
\xff\xf2\xf2\xbd\xd6kk\xb1\xdeooT\x91\xc5\xc5P`00\x03\x02\x01\x01\xa9\xcegg}V++\x19\xe7\xfe\xfeb\xb5\xd7\xd7\xe6M\xab\xab\x9a\xecvvE\x8f\xca\xca\x9d\x1f\x82\x82@\x89\xc9\xc9\x87\xfa}}\x15\xef\xfa\xfa\xeb\xb2YY\xc9\x8eGG\x0b\xfb\xf0\xf0\xecA\xad\xadg\xb3\xd4\xd4\xfd_\xa2\xa2\xeaE\xaf\xaf\xbf#\x9c\x9c\xf7S\xa4\xa4\x96\xe4rr FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => m\xd6G\x13\x9a\xd7a\x8c7\xa1\x0czY\xf8\x14\x8e\xeb\x13<\x89\xce\xa9'\xee\xb7a\xc95\xe1\x1c\xe5\xedzG\xb1<\x9c\xd2\xdfYU\xf2s?\x18\x14\xceys\xc77\xbfS\xf7\xcd\xea_\xfd\xaa[\xdf=o\x14xD\xdb\x86\xca\xaf\xf3\x81\xb9h\xc4>8$4,\xc2\xa3@_\x16\x1d\xc3r\xbc\xe2%\x0c(<I\x8b\xff
\x95A9\xa8\x01q\x08\x0c\xb3\xde\xd8\xb4\xe4\x9cdV\xc1\x90{\xcb\x84a\xd52\xb6pHl\t\xd0\xb8WBPQ\xf4\xa7S~Ae\xc3\x1a\x17\xa4\x96:'^\xcb;\xabk\xf1\x1f\x9dE\xab\xac\xfaX\x93K\xe3\x03U 0\xfa\xf6\xadvm\x91\x88\xccv%\xf5\x02L\xfcO\xe5\xd7\xd7\xc5*\xcb\x80&5D\x8f\xb5b\xa3I\xde\xb1Zg%\xba\x1b\x98E\xea\x0e\xe1]\xfe\xc0\x02\xc3/u\x12\x81L\xf0\xa3\x8dF\x97\xc6k\xd3\xf9\xe7\x03\x8f_\x95\x15\x92\x9c\xeb\xbfmz\xda\x95RY-\xd4\xbe\x83\xd3Xt!)I\xe0i FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \xfb\x0bA.\x9a\xd7a\x8c\x94\xdel\x87\x86\xc5{\x9a\x88\xccv\x91\xa2\xf3U\xa0\xac\xfaX\xab\xbe\xe1O\xb6\xb0\xe8B\xbd\xea\x9f \xd4\xe4\x96\x04\xdf\xf6\x8d\x13\xc2\xf8\x84\x1e\xc9\xd2\xbb=\xf8\xdc\xb20\xf3\xce\xa9'\xee\xc0\xa0*\xe5zG\xb1<tN\xbc7fU\xab*h\\xa6!Bc\x85\x10Lj\x88\x1b^q\x9f\x06Px\x92
\x0f\xd9d\x04\x06\xd4o\x16\x1d\xc3r\x18\x14\xcey2+\xedH<"\xe0C.9\xf7^ 0\xfaU\xec\x9a\xb7\x01\xe2\x93\xba
\xf0\x88\xad\x17\xfe\x81\xa0\x1c\xd4\xbe\x83-\xda\xb7\x8e&\xc8\xac\x99;\xc6\xa5\x940\x9c\xd2\xdfY\x92\xdb\xd2R\x80\xc0\xc5O\x8e\xc9\xc8D\xa4\xf6\xebu\xaa\xff\xe6~\xb8\xe4\xf1c\xb6\xed\xfch\x0c
g\xb1\x02\x03j\xba\x10\x18}\xa7\x1e\x11p\xac4.S\x9d:'^\x96(<I\x8b&5D\x80|B\x0f\xe9rK\x02\xe2`P\x15\xffnY\x18\xf4Df;\xc5Jo6\xceXt!\xd3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \xce>'\xca\x07\xc2\xc0!\xc7\xb8\x86\xd1\x1e\xeb\xe0\xcd\xd6}\xda\xeax\xd1n\xee\x7fO}\xf5\xbao\x17r\xaag\xf0\x06\xa6\x98\xc8\xa2\xc5}c
\xae
\xf9\xbe\x04\x98?\x11\x1bG\x1c\x135\x0bq\x1b\x84}\x04#\xf5w\xdb(\x93$\xc7@{\xab\xca2\xbc\xbe\xc9\x15
\xbe\x9e<L
\x10\x9c\xc4g\x1dC\xb6B>\xcb\xbe\xd4\xc5L*~e\xfc\x9c)\x7fY\xec\xfa\xd6:\xabo\xcb_\x17XGJ\x8c\x19Dl\x98/\x8aB\x91D7q\xcf\xfb\xc0\xb5\xa5\xdb\xb5\xe9[\xc2V9\xf1\x11\xf1Y\xa4\x82?\x92\xd5^\x1c\xab\x98\xaa\x07\xd8\x01[\x83\x12\xbe\x851$\xc3}\x0cUt]\xber\xfe\xb1\xde\x80\xa7\x06\xdc\x9bt\xf1\x9b\xc1\xc1i\x9b\xe4\x86G\xbe\xef\xc6\x9d\xc1\x0f\xcc\xa1\x0c$o,\xe9-\xaa\x84tJ\xdc\xa9\xb0\\xda\x88\xf9vRQ>\x98m\xc61\xa8\xc8'\x03\xb0\xc7\x7fY\xbf\xf3\x0b\xe0\xc6G\x91\xa7\xd5Qc\xca\x06g))\x14\x85
\xb7' FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \x00\x00\x00\xffu\x18\xffu\x14\xffu\x10\xffvxVh\x90\x98\x01h\xe8\xcb\xf9\xff\xff\x85\xc0\x0f\x85\xc0\x00\x00\x009E\x10\x0f\x84\xb5\x00\x00\x00\x8bE\x0c\x85\xc0\x0f\x84\xaa\x00\x00\x00\x81x\x04\x05\x80\x00\x00\x0f\x85\x9d\x00\x00\x00\x83~`\x01\x0f\x85\x93\x00\x00\x00\x8bNxW\x8bx\x10\x8b\xd1\x83\xc7\x04\xc1\xe9\x02\x83\xc6,\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4_\xebq\xb8\x08\x00 \x80\xebp\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xa0t\x01h\xeb$\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xd0f\x01h\xeb\x11\xffu\x18\xffu\x14\xffu\x10j\x08Vh V\x01h\xe87\xf9\xff\xff\x85\xc0u09E\x10t)\x8bE\x0c\x85\xc0t"\x81x\x04\x05\x80\x00\x00u\x19\x83~`\x01u\x13\x8bV,\x8bH\x10\x89Q\x04\x8bV0\x89Q\x08\x83H4\x013\xc0^]\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x14V3\xf6\xf7E\x18\xbf\xff\xff\xff\x89u FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => v\x81\xf9\x02f\x00\x00tX\x81\xf9\x03f\x00\x00t:\x81\xf9 f\x00\x00t2\x81\xf9
f\x00\x00vl\x81\xf9\x10f\x00\x00wd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00\xffpxPh\x90\x98\x01h\xe8\xfe\xe7\xff\xff\x85\xc0tF\x8b\xf0\xebf\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xa0t\x01h\xeb\xdd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xd0f\x01h\xeb\xc7\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph V\x01h\xeb\xb1\x8bu\xf0\x8bE\x10\x8bU\xec\x03\xf2\x8b\xc8\x8b\xd1\xc1\xe9\x02\x8d{\x14\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x89\x033\xff3\xf6\x83}\xf4\x00t\x08\xffu\xf4\xe8\xf0\xa0\x01\x00\x8bE\xfc\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8bE\xf8\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8b\xc6\x8de\xe0_^[\xc9\xc2\x10\x00\xcc\xcc\xcc FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \xe9\x02\xf3\xa5\x8b\xc8\x8bE\xfc\x83\xe1\x03\xf3\xa4\x8bu\x08\x03\xc3\x01E\x14\x8b}\x14\x8b\xcb\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\x08\x83\xe1\x03\xf3\xa4\x8bJ\x04\x8d4\x18\x8bE\x14\xc1\xe9\x03\x8d<\x18\x03}\xfc\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\xf4\x83\xc0\xecP\xffu\x0c\x83\xe1\x03\xf3\xa4\xe8\x9f\x91\x01\x00\x85\xc0t\x043\xc0\xeb&\x8b}\xf0\x8bu\xf43\xc0@\x8bM\x18\x899\x8bM\x10\x891\xeb\x113\xc0\xeb\xf0\x8bE\x18\x898\x8bE\x10\x8903\xc0@_[^\xc9\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c%\x00\xe0\x00\x00=\x00\x80\x00\x00u\x043\xc0\xeb\x1a\x8bE\x08\x8b\x80\x84\x01\x00\x00j\x00\xffu\x0c\xff4\x85(\x18\x03h\xe8c\xe1\x01\x00]\xc2\x08\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c\x8bM\x14W3\xff-\x00$\x00\x00\x899t\x19-\x01(\x00\x00td\x83\xe8\x03tTHtFHtY-\xfaW\x00\x00u\x06 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \xfa\x10f\x00\x00w\x05\x8bIx\xeb\x8a\x83&\x00\xebA\xc7\x06@\x00\x00\x00\xeb9\x8bM\x1c\x8bI\x10\x85\xc9u\x07\xb9
\x00 \x80\xeb:\x8bI\x08\x89\x0e\xeb!\xf7\xde\x1b\xf6\x81\xe6\xea\x00\x00\x00\x8b\xce\xeb#\x8bM\x14\x85\xc9t\x129\x18r\x0e\x8bU\x1c\x8bR\x04\x89\x11\x89\x183\xc9\xeb\x0c\xf7\xd9\x1b\xc9\x81\xe1\xea\x00\x00\x00\x89\x18_[3\xc0\x85\xc9\x0f\x94\xc0\x8b\xf0\x85\xf6u\x07Q\xff\x15\xc4\x11\x00h\x8b\xc6^]\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSV\x8bu\x083\xc0\xf6\x06 Wt\x01@\x83}\x0c\x02u\x13\xbb\x84\x12\x00h\xbf|\x12\x00h\xc7E\x08t\x12\x00h\xeb\x17\x83}\x0c\x01uP\xbbl\x12\x00h\xbfd\x12\x00h\xc7E\x08\\x12\x00h\x83\xbeX\x01\x00\x00\x00t\x15j\x00P\xffu\x0ch\xb0\x1a\x03hV\xe8\xcb\xab\x00\x00\x85\xc0u&W\x8b=\xc4\x10\x00h\x81\xc6@\x01\x00\x00\xff6\xff\xd7\xffu\x08\xff6\xff\xd7S FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \x8bu \x85\xf6t\x1d3\xc9;\xc1v\x17\x8dE\xdc+\xf0\x8dD
\xdc\x8a\x1c\x060\x18A;M\x18r\xf1\x8b]\xd8\x8b}\x08\x81\xff\x01f\x00\x00\x0f\x84\xf1\x00\x00\x00\x81\xff\x02f\x00\x00\x0f\x84\xbc\x00\x00\x00\x81\xff\x03f\x00\x00\x0f\x84\x87\x00\x00\x00\x81\xff f\x00\x00t\x7f\x81\xff
f\x00\x00vm\x81\xff\x10f\x00\x00v6;\xfaua\x8bM\x18\x8bu\xd0\x8b\xc1\xc1\xe9\x02\x83}$\x01\x8d}\xect\x03\x8bu\xd4\xf3\xa5\x8b\xc8\x8dE\xecP\xffu\x18\x83\xe1\x03S\xf3\xa4\xe8\x18\xec\x00\x00\xe9\xb2\x00\x00\x00\x83}$\x01u\x15j\x01S\x8dE\xdcP\x8dE\xecP\xe8\x8d\xea\x00\x00\xe9\x9d\x00\x00\x00j\x00S\xffu\xd4\x8dE\xecP\xe8y\xea\x00\x00\xe9\x83\x00\x00\x00\xbe\x08\x00 \x80\xe9\xc7\x00\x00\x00\x83}$\x01u\x12j\x01S\x8dE\xdcP\x8dE\xecP\xe8d\xc6\x00\x00\xebgj\x00S\xffu\xd4\x8dE\xecP\xe8S\xc6\x00\x00\xebP\x83}$\x01u FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \x01\x00\x00\x8dE\xf4PV\xffu\x18\xe8\xcd\xcb\xff\xff\x85\xc0\x0f\x84D\x01\x00\x009u\xf0\x8bE\xf4\x8bM\x14\x8d<\x01u\x17W\xe8@a\x01\x00\x8b\xd8;\xde\x89]\xecu\x11j\x08^\xe9\xb6\x01\x00\x00\x8b]\xf8\x83\xc3\x08\x89]\xec\x8dE\xf4PS\xffu\x18\xe8\x8a\xcb\xff\xff\x85\xc0\x0f\x84\x01\x01\x00\x009u\x10t\x1eVW\x8dE\xf4PSVj\x01V\xffu\x10\xffu\x08\xe8\xd4\xab\xff\xff;\xc6\x0f\x85\xb8\xfd\xff\xff\x83}\xf0\x00\x8bM\xf4\x8dY\x08\x0f\x85<\x01\x00\x00\x8b}\x1c\x8bu\xec\x83\xc7\x08\xe96\x01\x00\x00\x8a\x06<\x03t\x08<\x04\x0f\x85\xb2\x00\x00\x00\x8bE\xfc\x8b@\x10\x85\xc0\x0f\x84\xb8\x00\x00\x00\x8bX\x08\x8bu\x1c\x83\xc3\x07\xc1\xeb\x03\x83\xc3\x14\x85\xf6\x0f\x84\x15\x01\x00\x00\x8bM 9\x19\x0f\x82
\x01\x00\x00\x8b\x08\x8bU\xf8\x89J\x08\x8bH\x08\x89J\x0c\x8bH\x10\x89J\x10\x8bH\x08\x83\xc1\x07\xc1\xe9\x03\x8dp\x14\x8b\xc1\xc1\xe9\x02\x8d FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => k\x83E\x90\x08u2\x8b\xb5|\xff\xff\xff\x8dF\x08;\xc6r\x18P\xff\x15\x18 \x03h;\xc7\x89E\x90t\x0f\xc7\x00Heap\x83E\x90\x089}\x90u\x08j\x08[\xe9\x85\x02\x00\x00\x8d\x85|\xff\xff\xffP\x8dE\x90P\x8bE\x94\xffp\x1c\xe8\x8d\xa5\xff\xff;\xc7\x0f\x85c\xfc\xff\xff\xffu\x88\x8bE\x94\xffu\x98\xffu\x90\xffp\x1c\xe8x\xa9\xff\xff;\xc7\x0f\x85G\xfc\xff\xff\xff\xb5t\xff\xff\xff\x8dE\x9cP\xffu\x90\x8bE\x94\xffp\x1c\xe8X\xa9\xff\xff;\xc7\x0f\x85'\xfc\xff\xff\x8bE\x94\x8bx\x10\x8b\x8d|\xff\xff\xff\x8bu\x90\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\x94\x83H \x02\x8bM\x80\x8b}\x8c\x8b\xd1\xc1\xe9\x02\x8b\xb5x\xff\xff\xff3\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bM\x88\x8b}\x98\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x94VS\xffp\x10\xffp\x18\xffp\x1c\xe8\x94\xf8\xff\xff\x85\xc0\xe9\xb1 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \xeb\x07\xc7E\xb8p\xf0\x02h\x8bU\x143\xf6\x85\xd2v\x13\x8bE\x10\x8dD\x10\xff\x8a\x08\x88L5\xbcFH;\xf2r\xf4\x8b]\x1c\x8b\xca\x8b\xfb\x8du\xbc3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0u~\xf6E\x18\x01\x8b\xca\x89M\xb4uG\x8bu\xb8\x85\xf6t@\x8b\x06\x808\x00t9\x89u\xb8\x0f\xb6\x18\x8dx\x01\x8bE\x1c\x8d4\x02\x8b\xcb3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0t\x13\x83E\xb8\x04\x8bE\xb8\x8b\x00\x808\x00u\xd5\x8bM\xb4\xeb\x03\x8d\x0c\x13\x8b]\x1c\x80<\x19\x00u&\x8bE\x08\x8b@\x0c\x80<\x18\x00u\x1a\x80|\x18\xff\x01u\x13AH\xeb\x07\x80<\x19\xffu A;\xc8r\xf53\xc0\xeb\x0c\xb8\x06\x00 \x80\xeb\x05\xb8\x02\x00 \x80\x8bM\xfc_^[\xe8\x92n\x00\x00\xc9\xc2\x18\x00\x10\xdd\x00h\x19\xdd\x00h"\xdd\x00h+\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17\xde\x00h4\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => _j\x06\x8dM\xc0Q\x8dM\xe4Q\xffu\xc8\x89}\xc0P\xffU\xb8;\xc3u\x06f9}\xc0t8\x83\xf82\x8bu\xcctSW\x8dE\xe4P\x8dF8P\x8dFXP\x8d\x86d\x01\x00\x00P\xe8\xb7\xe9\xff\xff;\xc3uSSj\x06W\x8dE\xe4P\xffu\xc8\xffu\xd4\xffU\xc4\xeb\x03\x8bu\xccW\xe8\x0c1\x01\x00;\xc3\x89\x86H\x01\x00\x00u\x08j\x08^\xe9\x1a\x01\x00\x00\x8du\xe4\xe9\xff\x00\x00\x00\x8dE\xd8PSSh\x03\x80\x00\x00\xffv\x0c\xe8\xd9\x86\xff\xff\x85\xc0u
\xff\x15\xc8\x11\x00h\x8b\xf0\xe9\xee\x00\x00\x00S\x8dE\xecPj\x02\xffu\xd8\xffv\x0c\xe8k\xb7\xff\xff\x85\xc0t\xdd\x8dE\xbcPj\x01\xffv\x0c\xffu\xd8\xe8\xf0$\x00\x00;\xc3t\x11= \x00 \x80u\xc7\xbe\x02\x00 \x80\xe9\xb2\x00\x00\x00\x8bE\xbc\xffu\xd0\x8b=\xbc\x11\x00h\x83`\x18\xfe\xff\xd7@P\xe8y0\x01\x00;\xc3\x89E\xe0tw\xffu\xd0P\xff\x15 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \xff\xff\xff6\xe8\xcc!\x01\x00\x8bu\x18\x89\x06\x8bE\x10\xff0\xe8T!\x01\x00;\xc3\x89\x07\x0f\x84r\xff\xff\xff\xff6\xe8C!\x01\x00;\xc3\x8bM\x0c\x89\x01\x0f\x84^\xff\xff\xff\xffu\xf0\xffu\xf8h\x01\x00\x01\x00\xffu\x1cP\xff7\xe8 \xfc\x00\x00\x8b\xf0\xf7\xde\x1b\xf6\x81\xe6\xb1\xfa\xff\xff\x81\xc6O\x05\x00\x00\x8dE\xdcP\x8d\x85p\xff\xff\xffP\xe8\xfbz\x01\x00\x85\xc0u\x0e;\xf3u
\xffu\xe4\xe8\xf6F\x00\x00\x8b\xf09]\xd0t"\x8dE\xdcP\x8d\x85\xc0\xfe\xff\xffP\xe8\xaev\x01\x00\x85\xc0u\x0e;\xf3u
\xffu\xe4\xe8\xcfF\x00\x00\x8b\xf09]\xect\x08\xffu\xec\xe8\xfb \x01\x009]\xf8t\x08\xffu\xf8\xe8\xee \x01\x009]\xf0t\x08\xffu\xf0\xe8\xe1 \x01\x00;\xf3t\x1b\x8b?;\xfbt\x06W\xe8\xd1 \x01\x00\x8bE\x0c\x8b\x00;\xc3t\x06P\xe8\xc2 \x01\x00_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \xdbC\x89]\xa8\x8bE\x18=\x00\x04\x00\x00r0P\x8dE\xccP\x8dE\xc8P\x8dE\xc4P\x8dE\xdcP\x8dE\xe0P\xe8\\xee\xff\xff\x89E\xe4\x85\xc0\x0f\x85\xfd\x01\x00\x00\x89]\xd0\x8b}\xdc\xe9\x8f\x00\x00\x00\x89E\xa4\x8dE\xa4P\x8dE\xc8P\x8dE\xc4P\xe8\xa9\xef\x00\x00\x85\xc0u\x0c\xc7E\xe4 \x00 \x80\xe9\xce\x01\x00\x00\xffu\xc4\xe8\x01\x11\x01\x00\x89E\xe0\x85\xc0u\x0c\xc7E\xe4\x08\x00\x00\x00\xe9\xb3\x01\x00\x00\x89]\xd0\xffu\xc8\xe8L\x11\x01\x00\x89E\xccP\xe8\xda\x10\x01\x00\x8b\xf8\x89}\xdc\x85\xfft\xd7\x8d\x86d\x01\x00\x00\x838\xfft\x10\x89E\x90\xc7E\x94o\xd7\x00h\x8dE\x90\x89E\xc0h\x01\x00\x01\x00\xffu\x18W\xffu\xe0\xffu\xc0\xe8\xf2\xe8\x00\x00\x85\xc0t\x89\x8bE\xcc\x83\xc0\xecP\x8dG\x14P\xe8\x1c\x11\x01\x00\x89E\xd8\x85\xc0\x0f\x85E\x01\x00\x00PSSW\xffu\xe0\xe8s\xfc\xff\xff\x89E\xd8\x85\xc0\x0f\x85.\x01\x00\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \x85\xe2\x00\x00\x00\xe8\x1f\xf7\xff\xff\x85\xc0\x0f\x84\xd5\x00\x00\x00\x8d\x85\xa4\xfe\xff\xffP\xe8\x8e\x80\x00\x00j\x03h\x1c\xf8\x02h\x8d\x85\xa4\xfe\xff\xffP\xe8K\x8c\x00\x00\x8d\x85|\xff\xff\xffP\x8d\x85\xa4\xfe\xff\xffP\xe8h\x8d\x00\x00\x8b\xcb\xbf \xf8\x02h\x8d\xb5|\xff\xff\xff3\xc0\xf3\xa7\x0f\x85\x8c\x00\x00\x00\x8d\x85\xd4\xfd\xff\xffP\xe85\x8e\x00\x00j\x03h@\xf8\x02h\x8d\x85\xd4\xfd\xff\xffP\xe8R\xbd\x00\x00\x8d\x85L\xff\xff\xffP\x8d\x85\xd4\xfd\xff\xffP\xe8\xbf\xc5\x00\x00j\x0cY\xbfD\xf8\x02h\x8d\xb5L\xff\xff\xff3\xc0\xf3\xa7uF\x8d\x85\x04\xfd\xff\xffP\xe8\x7f\x8e\x00\x00j\x03ht\xf8\x02h\x8d\x85\x04\xfd\xff\xffP\xe8\x0c\xbd\x00\x00\x8d\x85\x0c\xff\xff\xffP\x8d\x85\x04\xfd\xff\xffP\xe8Y\xbe\x00\x00j\x10Y\xbfx\xf8\x02h\x8d\xb5\x0c\xff\xff\xff3\xc0\xf3\xa7t
\xb8 \x00 \x80\xe9\xfa\x01\x00\x00j\x00h\x8c\xf6\x02hj\x05h\x84\xf6\x02hj FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03\x00\x00\x89H\x10\x8b\x8bX\x03\x00\x00\x89H\x14\x8b\x8b\\x03\x00\x00\x89H\x18\x8b\x8b4\x01\x00\x00\x89\x88\x1c\x01\x00\x00\x8b\xd1\xc1\xe9\x02\x8ds4\x8dx\x1c\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8b8\x02\x00\x00\x89\x88 \x02\x00\x00\x8b\xd1\xc1\xe9\x02\x8d\xb38\x01\x00\x00\x8d\xb8 \x01\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bD\x03\x00\x00\x89\x88,\x03\x00\x00\x8d\xb8,\x02\x00\x00\x8b\xc1\xc1\xe9\x02\x8d\xb3D\x02\x00\x00\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\xe9\x1b\x02\x00\x00\x8bJ\x0c\x89\x880\x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,401 | 1660 | NtReadFile |
Buffer => \x00+\xc1\x89u\xcc\x89U\xd8\x89U\xd0\x89U\xc4\x89U\xc0\x0f\x84H\x01\x00\x00\x83\xe8\x04t
\xbe\x08\x00 \x80\xe9\x97\x01\x00\x00\xf6\x834\x04\x00\x00\x01\x8b{\x0c\x8bC\x04\x89}\xd4\x89E\xc8\x0f\x84\xcd\x00\x00\x00\xffu\x14\x8dE\xf4P\x8dE\xd0P\x8dE\xdcP\x8dE\xccP\x8dE\xd4P\x8dE\xc4PS\xe8<\xfe\xff\xff\x85\xc0\x0f\x852\x01\x00\x00\x8bE\xcc\xf6E\x14\x01t\x07\xc7E\xc0\x01\x00\x00\x00\x8dM\xd8Qj\x01j\x00P\xff6W\xffu\xc0\xffu\xc8\xe8\xf8G\xff\xff\x85\xc0\x0f\x85\x03\x01\x00\x00\x81}\xc8\x02f\x00\x00u
\x8bE\xd8\xc7@l\x80\x00\x00\x00\x8b}\xd8\x8bM\xd0\x8b\xc1\xc1\xe9\x02\x83\xc7D\x8du\xdc\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\xd8\x8bM\xd0\x89H@\x8b[\x18\x85\xdbt\x19\x8b}\xd8\x8b\xcb\x8b\xc1\xc1\xe9\x02\x83\xc7\x1c\x8du\xf4\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4j\x00\xffu\xd8\xffu\xbc\xe8\xdbI\xff\xff\x85\xc0\x0f\x85\x85 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x8b@\xfc\x89\x85\xdc\xfd\xff\xffj\x14Y3\xc0\x8d\xbd\xd0\xfc\xff\xff\xf3\xab\xc7\x85\xd0\xfc\xff\xff \x04\x00\xc0\x8bE\x04\x89\x85\xdc\xfc\xff\xff\x8d\x85\xd0\xfc\xff\xff\x89E\xf8\x8d\x85(\xfd\xff\xff\x89E\xfc\xa1\x84\x18\x03h\x89\x85 \xfd\xff\xff\xa1\x80\x18\x03h\x89\x85$\xfd\xff\xffj\x00\xff\x15\xd4\x10\x00h\x8dE\xf8P\xff\x15\xd8\x10\x00hh\x02\x05\x00\x00\xff\x15\xdc\x10\x00hP\xff\x15\xe0\x10\x00h_\xc9\xc3\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xf69u\x0cu\x0e95\x9c\x1a\x03h~-\xff
\x9c\x1a\x03h\x83}\x0c\x01\xa1\xf0\x11\x00h\x8b\x00\xa3\x00 \x03hu=h\x80\x00\x00\x00\xff\x15\xec\x11\x00h;\xc6Y\xa3\x08 \x03hu\x043\xc0\xebg\x890\xa1\x08 \x03hh\x08\xf0\x02hh\x00\xf0\x02h\xa3\x04 \x03h\xe8\xac\x01\x00\x00\xff\x05\x9c\x1a\x03hY\xeb?9u\x0cu;\xa1\x08 \x03h;\xc6t2\xeb\x13\x8b
\x04 \x03h\x8b ; FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => t3\xc63\xd6%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xfd\x8b\xa9\xb8\x1a\x00h3\xfd\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xfd\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xfd\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xfb\x8b\x99\xb8\x1f\x00h3\xfb\x8b\x98\xb8\x1c\x00h3\xfb\x8b\x9a\xb8\x1d\x00h3\xfb\x8bEx3\xdb\x8bU|3\xc73\xd7%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xf5\x8b\xa9\xb8\x1a\x00h3\xf5\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xf5\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xf5\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xf3\x8b\x99\xb8\x1f\x00h3\xf3\x8b\x98\xb8\x1c\x00h3\xf3\x8b\x9a\xb8\x1d\x00h3\xf3\x8bT$\x14\xd1\xce\x8b\xc73\xfe\x81\xe7\xaa\xaa\xaa\xaa3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\x8b\xc7\xf7\xd0\x8b\xef#\xc1#\xea\x03\xd8\x8b\x06\x03\xdd\x03\xd8\xc1\xe8\x10\x8b\xef\x03\xc83\xc0f\xd1\xc3f\x8b\xc3#\xe8\x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\xe9h\x06\x00\x00\x8d\xa4$\x00\x00\x00\x00\x90\x83\xc6xf\xc1\xcf\x05\x8b\xc2\x8b\xea\x83\xf0\xff#\xe9#\xc3f\xc1\xca\x03\x03\xc5+\xf8\x8bF\x04\x8b\xe9+\xd0\xc1\xe8\x10+\xf8\x8b\xc1\xf7\xd5#\xc3#\xef\x03\xe8f\xc1\xc9\x02+\xd5\x8b\xc3\x8b\xef\xf7\xd0#\xeb#\xc2f\xd1\xcb\x03 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => h34\x9d\xd81\x00h\x8b]\xf8\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf434\x9d\xd8)\x00h\x0f\xb6]\xf2\x89p\x08\x0f\xb6u\xf7\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x0f\xb6\xd6\x8b\x1c\x95\xd8-\x00h\x0f\xb6U\xf83\xf334\x95\xd8)\x00h\x8bX\x04\x89p\x0c\x8b0\x8bQ\x083\xd6\x8bq\x0c3\xf3\x8bX\x08\x89u\xf0\x8bq\x103\xf3\x8bX\x0c\x89u\xf4\x8bq\x14\x89U\xec3\xf3\x89u\xf8\x8b]\xf4\xc1\xee\x18\x8b4\xb5\xd85\x00h\xc1\xeb\x10\x0f\xb6\xdb34\x9d\xd81\x00h\x8b]\xf0\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6\xda34\x9d\xd8)\x00h\x8b]\xf8\x890\xc1\xeb\x10\x0f\xb6\xdb\x8b\xf2\xc1\xee\x18\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x8b]\xf4\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf034\x9d\xd8)\x00h\x0f\xb6]\xee\x89p\x04\x8bu\xf0\xc1\xee\x18\x8b4\xb5\xd85 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xc7E\xe8\x02\x00\x00\x00\xeb\x03\x8dI\x00\x8bQ\xf83\x10\x8bq\xfc3p\x04\x89u\xf0\x8b9\x8bp\x083\xf7\x89u\xf4\x8bY\x043X\x0c\x8bu\xf0\x0f\xb6}\xf6\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xff34\xbd\xd8=\x00h\x0f\xb6\xfa34\xbd\xd89\x00h\x89U\xec\x890\x8bu\xf4\xc1\xee\x18\x8b4\xb5\xd8E\x00h\x89]\xf8\x0f\xb6}\xfa34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf03\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xee\x89p\x04\x8b\xf3\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf43\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xf2\x89p\x08\x0f\xb6u\xef\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd634\x95\xd8=\x00h\x0f\xb6\xd3\x8b<\x95\xd89\x00h\x8bX\x043\xf7\x8bx\x08\x89p\x0c\x8b0\x8bQ\xe83 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xc8\x8b\xf1\xc1\xe9\x02\x8d|\x05\xbc3\xc0\xf3\xab\x8b\xce\x83\xe1\x03\xf3\xaa\x8b]\xb4\x8bu\xb8\xb9\x07\x00\x00\x00+\xcb\x8a\\x15\xbc\xb8\x01\x00\x00\x00\xd3\xe0\x8a\xc8\xfe\xc9
\xd8\xf6\xd1"\xcb\x83\xfa7\x88L\x15\xbc[v6\x8dU\xbcRV\xe8\x91a\x00\x003\xc0\x89E\xbc\x89E\xc0\x89E\xc4\x89E\xc8\x89E\xcc\x89E\xd0\x89E\xd4\x89E\xd8\x89E\xdc\x89E\xe0\x89E\xe4\x89E\xe8\x89E\xec\x89E\xf0\x8bN\x10\x8bV\x14\x8dE\xbcPV\x89M\xf4\x89U\xf8\xe8Oa\x00\x00\x8bM\xfc_\xc7F\x18\x01\x00\x00\x003\xc0^\xe8\xc5\xae\xff\xff\x8b\xe5]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x083\xc9\xc7\x00g\xe6 j\xc7@\x04\x85\xaeg\xbb\xc7@\x08r\xf3n<\xc7@\x0c:\xf5O\xa5\xc7@\x10\x7fR\x0eQ\xc7@\x14\x8ch\x05\x9b\xc7@\x18\xab\xd9\x83\x1f\xc7@\x1c\x19\xcd\xe0[\x89H \x89H$]\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xff\xff\x89}\xd8\x8bx\x1c\x89\x95<\xfc\xff\xff\x89U\xb4\x8bP \x89\xbd@\xfc\xff\xff\x89}\xb8\x8bx$\x89\x95|\xfc\xff\xff\x89U\xdc\x8bP(\x89\xbd\x80\xfc\xff\xff\x89}\xe0\x8bx,\x89\x95L\xfc\xff\xff\x89U\xbc\x8bP0\x89\x8d\x9c\xfc\xff\xff\x89M\xcc\x8bH\x0c\x89\xbdP\xfc\xff\xff\x89}\xc0\x8bx4\x89\x95l\xfc\xff\xff\x89U\xc4\x8bP8\x8b@<\x89\x850\xfc\xff\xff\x89E\xf0\x89\x8d`\xfc\xff\xff\x89\xbdp\xfc\xff\xff\x89}\xc8\x89\x95,\xfc\xff\xff\x89U\xec3\xc0\xeb\x03\x8bu\x0c\x8b\x1e\x8bV\x04\x83\xc6\x08\x89u\x0c3\xf6\x0b\xd63\xff\x0b\xfb\x8b\xda\x89]\x94\x89}\x98\x8b\xf7\x0f\xa4\xdf\x08\x0f\xac\xf2\x08\xc1\xe3\x083\xd3\x8b]\x98\xc1\xee\x083\xf7\x8b}\x94\x0f\xa4\xfb\x08\x81\xe2\xff\x00\xff\x00\xc1\xe7\x083\xd7\x8b\xfa\x89U\x94\x81\xe6\xff\x00\xff\x003\xf3\x8b\xde\x0f\xac\xdf\x10\xc1\xeb\x10\x89u\x98\x0f\xa4\xd6\x103\xde\x8bu\x98\xc1\xe2\x103\xfa\x8bU FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xcc\x89\x8d\x88\xfc\xff\xff\x8b\xce\xf7\xd1#\xcb\x8b]\xd0\xf7\xd2#\xd3\x8b]\xec#\xde\x8bu\xf0#u\xc83\xcb\x8b\x9dp\xfe\xff\xff3\xd63\xbdl\xfe\xff\xff\x8b\xb5\x88\xfc\xff\xff3\xf33\xbd\\xfe\xff\xff3\xb5`\xfe\xff\xff\x8b\x1c\xc5T[\x00h\x03\xcf\x8b\xbc\xc5\xac\xfc\xff\xff\x13\xd6\x03\x0c\xc5P[\x00h\x8b\xb4\xc5\xb0\xfc\xff\xff\x13\xd3\x8b]\xa4\x03\xcf\x8b}\xa8\x13\xd6\x8bu\xbc\x03\xcb\x13\xd7\x03\xf1\x89M\xe4\x8bM\xc0\x13\xca\x89u\xbc\x89U\xe8\x8bU\xd8\x89M\xc0\x8bM\xd4\x8b\xf2\x8b\xf9\x0f\xac\xf7\x1c\x0f\xac\xce\x1c\x89\xb5P\xfe\xff\xff\x8b\xf2\x89\xbdL\xfe\xff\xff\x8b\xfe\x8b\xf1\x89}\xfc\x0f\xac\xf7\x02\x89\xbdt\xfc\xff\xff\x8b\xfa\x0f\xac\xfe\x02\x8b\xbdt\xfc\xff\xff\x89\xb50\xfe\xff\xff\x89\xbd,\xfe\xff\xff\x8b\xf2\x8b\xfa\x8b\xdf\x8b\xf1\x0f\xac\xf3\x07\x0f\xac\xfe\x07\x89\x9d<\xfe\xff\xff\x8b]\xb83\xda#]\xe0\x89\xb5@\xfe\xff\xff\x8bu\xb4\x8b\xfe#\xf13\xf9# FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xbc\x8b\xd6\x8b\xf9\x0f\xac\xd7\x1c\x0f\xac\xca\x1c\x89\x95H\xfe\xff\xff\x89\xbdD\xfe\xff\xff\x8b\xd6\x8b\xfe\x89}\xf8\x8b\xd1\x0f\xac\xd7\x02\x89\xbd\xb4\xfa\xff\xff\x8b\xfe\x0f\xac\xfa\x02\x8b\xbd\xb4\xfa\xff\xff\x89\x95\xb8\xfe\xff\xff\x8b\xd6\x89\xbd\xb4\xfe\xff\xff\x8b\xfa\x8b\xd1\x8b\xdf\x0f\xac\xd3\x07\x0f\xac\xfa\x07\x89\x9d\x04\xfe\xff\xff\x8b]\xc83\xde#]\xf0\x89\x95\x08\xfe\xff\xff\x8bU\xc4\x8b\xfa#\xd13\xf9#}\xec\x8bM\xc83\xfa\x8b\x95\xb4\xfe\xff\xff#\xce3\xd9\x8b\x8d\x04\xfe\xff\xff3\xca3\x8dD\xfe\xff\xff\x8b\x95\x08\xfe\xff\xff3\x95\xb8\xfe\xff\xff3\x95H\xfe\xff\xff\x03\xf9\x13\xda\x8bU\xe4\x8bM\xe8\x03\xfa\x13\xd9\x8bM\xfc\x89]\xe0\x8b]\x0c\x89}\xdc\x8b}\xa0@AC\x89M\xfc\x89]\x0c\x83\xe1\x0f\x8b\x94\xcd\xac\xfc\xff\xff\x8b\x8c\xcd\xb0\xfc\xff\xffG\x8b\xda\x89}\xa0\x8b\xf9\x0f\xac\xfb\x01\x89\x9dT\xfb\xff\xff\x8b\xda\x0f\xac\xdf\x01\x8b\x9dT\xfb\xff\xff\x89\x9d\xc4\xfe\xff\xff\x8b\xda FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff\xc1\xef\x103\xf9\x8b\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x10\x81\xe2\xff\xff\x00\x003\xd0\x8b\x85P\xff\xff\xff\x81\xe7\xff\xff\x00\x003\xf9\xc6\x85l\xff\xff\xff\x80\x89\x94\x05\\xff\xff\xff\x89\xbc\x05`\xff\xff\xff\x8b\xbdh\xff\xff\xff3\xc0\x0b\xf8\x8b\x85d\xff\xff\xff3\xd2\x0b\xd0\x89\x95X\xff\xff\xff\x89\xbdT\xff\xff\xff\x8b\xcf\x8b\xc2\x0f\xac\xc1\x08\x0f\xa4\xfa\x08\xc1\xe8\x08\x89\x85h\xff\xff\xff\x8b\xc1\x8b\x8dh\xff\xff\xff3\xca\x8b\x95T\xff\xff\xff\xc1\xe7\x083\xc7\x8b\xbdX\xff\xff\xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x00h\x84\xdb\x8b\xd7\x8b\xf1t\x0e\xc1\xe6\x1a\xc1\xe9\x02\xc1\xe2\x1a\xc1\xef\x02\xeb
\xc1\xe6\x1b\xd1\xe9\xc1\xe2\x1b\xd1\xef\x0b\xd7\x0b\xf1\x81\xe6\xff\xff\xff\x0f\x8b\xce\xd1\xe9\x8b\xf9\x81\xe7\x00\x00\x00\x07\x89M\x0c\x8b\xde\x81\xe3\x00\x00\xc0\x00\x0b\xfb\xd1\xef\x8b\xde\x81\xe3\x00\x00\x10\x00\x0b\xfb\xc1\xef\x14\x8b\xd9\x81\xe3\x00\x00\x06\x00\x8b\xce\x81\xe1\x00\xe0\x01\x00\x0b\xd9\x8b\x0c\xbd\xb8#\x00h\xc1\xeb
\x0b\x0c\x9d\xb8"\x00h\x8b}\x0c\x81\xe7\x00\x0f\x00\x00\x81\xe2\xff\xff\xff\x0f\x8b\xde\x81\xe3\xc0\x00\x00\x00\x0b\xfb\xc1\xef\x06\x0b\x0c\xbd\xb8!\x00h\x8b\xfe\x83\xe7?\x0b\x0c\xbd\xb8 \x00h\x8b\xfa\xd1\xef\x89}\xfc\x81\xe7\x00\x00\x00\x06\x8b\xda\x81\xe3\x00\x00\xe0\x01\x0b\xfb\x8b]\xfc\x81\xe3\x00\x1e\x00\x00\x89U\x08\x81\xe2\x80\x01\x00\x00\x0b\xda\xc1\xef\x15\x8b\x14\xbd\xb8'\x00h\xc1\xeb\x07\x0b\x14\x9d\xb8%\x00h\x8b}\x08\x8b\xdf\xc1\xeb\x0f\x83\xe3?\x0b\x14\x9d\xb8&\x00h\x83\xe7?\x0b\x14\xbd\xb8$\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xec\x8bE\x10\x8b\x08\xf6\xc1\x01u9\x83\xf9 r4\xd1\xe9\x89\x08\x8b\xc1\xc1\xe8\x05@\xf6\xc1\x1ft\x01@\x8d\x0c\x80\x8d\x14\xcd\x14\x00\x00\x00\x8bM\x0c\x89\x11\x8d\x14\xc5\x14\x00\x00\x00\x8bE\x08\x89\x10\xb8\x01\x00\x00\x00]\xc2\x0c\x003\xc0]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec\x90\x00\x00\x00S\x8b]\x08\x8b\x03W3\xff=RSA1\x89}\xfct
_3\xc0[\x8b\xe5]\xc2\x0c\x00\x8bC\x08\xd1\xe8V\x8b\xf0\xc1\xee\x05F\xa8\x1ft\x01F\x8bK\x10\xb8\x01\x00\x00\x00;\xc8\x8d\x0c6u\x11\x8bu\x0c\x8b}\x10\xf3\xa5^_[\x8b\xe5]\xc2\x0c\x00\x8dC\x14QP\x89E\xf8\x8bE\x0cP\x89M\x08\xe8#\x08\x00\x00\x85\xc0}b\xc1\xe6\x03\x81\xfe\x88\x00\x00\x00v\x14Vj\x00\xff\x15\x00\x11\x00h\x85\xc0\x89E\xfctG\x8b\xd0\xeb\x06\x8d\x95p\xff\xff\xff3\xc0\x8b\xce\xc1\xe9\x02\x8b\xfa\xf3\xab\x8b\xce\x83 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xd5\xf8\xff\xff\xff\x89M\x14\xeb\x06\x8bu\xf4\x8bE\x10\x8bM\xcc3\xd2\x8a4\x06\x8aT\x06\xff\x8b\xc2\xc1\xea\x08;\xcau
\xbe\xff\x00\x00\x00\x89u\x1c\xeb 3\xd2\xf7\xf1\x89E\x1c\x8b\xf0\x8b\xc6%\x00\x00\x00\x80\xf7\xd8\x1a\xc0\x8bM\xfc\x8b}\xf8\x89]\xd8\x8d\x0c\x8d\xfc\xff\xff\xff\x8b\xd1\x897%\xff\x00\x00\x00\x0f\xb6\xc0\x8a\xd8\x8bu\xfc\x8a\xfb\xc1\xe9\x02\x83\xc7\x04V\x8b\xc3\xc1\xe0\x10f\x8b\xc3\x8b]\xd8\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\xf8\x8bM\xf0PQS\xe8\xfd\xf6\xff\xff\x8b}\xec\x8d\x0c\xb5\x00\x00\x00\x00\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x14\x8b}\xec\x8b\xc8\x83\xe1\x1f\xba\x01\x00\x00\x00\xd3\xe2V\xc1\xe8\x05S\x89\x14\x87\x8bE\xf8WP\xe8\xbf\xf6\xff\xff\x8bM\xf8\x8bU\xf4VQRS\xe8T\x04\x00\x00\x8bG\xfc\x85\xc0y)\x8bE\xf0\x8bM\xf8VPWQ\xe8\x9a\xf6\xff\xff\x8bU\xf8VRSS\xe8\xee\x03\x00\x00\x8bM FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x00+\xc1\x83\xd2\x00\x89D\xaf\x0c\x8b\xca\x83\xc5\x04u\x96]\x8b\xc1_^[]\xc2\x10\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSVW\x8bu\x0c\x8b}\x08\x8bM\x103\xdb\x8b\x06\x83\xc6\x04\xf7\xe0\x03\xd8\x8b\x07\x83\xd2\x00\x03\xc3\x8b_\x04\x83\xd2\x00\x89\x07\x03\xd3\xbb\x00\x00\x00\x00\x89W\x04\x83\xd3\x00\x83\xc7\x08Iu\xd5_^[]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xccj\x08hx`\x00h\xe8\x9e1\xff\xff\x83e\xfc\x00\xffu\x08\xff\x15\xb4\x11\x00h\x83M\xfc\xff3\xc0\xeb\x1e\x8bE\xec\x8b\x00\x8b\x003\xc9=\x17\x00\x00\xc0\x0f\x94\xc1\x8b\xc1\xc3\x8be\xe8\x83M\xfc\xffj\x08X\xe8\xa11\xff\xff\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec]\xff%\xb8\x11\x00h\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec@VWj\x0eY3\xc0\x8d}\xc0\xf3\xab\x8dE\xfcPj\x013\xf6!u\xfc!u\xf8j\x08\xff\x15\x08\x11\x00hP\xff\x15 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xff\xff\xff\xd6\x85\xc0t%\x8d\x85\xe4\xfb\xff\xffPSSSSSSSj\x123\xf6FV\x8d\x85\xf4\xfb\xff\xffP\xff\x15D\x10\x00h\x85\xc0u
\xff\x15\xc8\x11\x00h\x8b\xf8\xeb\x1c\x8b\x85\xdc\xfb\xff\xff\xff0\xff\xb5\xe4\xfb\xff\xff\xff\x15P\x10\x00h\x85\xc0t\x02\x8973\xff9\x9d\xe0\xfb\xff\xfft\x0b\xff\xb5\xe0\xfb\xff\xff\xe8I\xf1\xff\xff9\x9d\xe4\xfb\xff\xfft\x0c\xff\xb5\xe4\xfb\xff\xff\xff\x15$\x10\x00h9\x9d\xe8\xfb\xff\xff\x8b5\x04\x11\x00ht\x08\xff\xb5\xe8\xfb\xff\xff\xff\xd69\x9d\xf0\xfb\xff\xfft\x08\xff\xb5\xf0\xfb\xff\xff\xff\xd6\x8bM\xfc\x8b\xc7_^[\xe8\xb8\x1e\xff\xff\xc9\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec \x04\x00\x00\xa1\x84\x18\x03hS\x89E\xfcV3\xdb\x8d\x85\xfc\xfb\xff\xffW\x8b}\x08\x89\x85\xe0\xfb\xff\xff\x8d\x85\xf0\xfb\xff\xffPj\x08\x89\x9d\xf0\xfb\xff\xff\xc7\x85\xec\xfb\xff\xff\x00\x04\x00\x00\x89\x9d\xe4\xfb\xff\xff\x89\x9d\xe8\xfb FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x00\x00\x8d\x85T\xff\xff\xffP\xe9Q\xff\xff\xff\x89\x8dP\xff\xff\xff\xe9\x82\x02\x00\x00W\xff\xb5H\xff\xff\xff\xff\x15,\x11\x00h\x83\xf8\xff\x0f\x84\xfb\xfe\xff\xff\x83\xf8\x1c\x0f\x82c\x02\x00\x00WWWj\x02W\xff\xb5H\xff\xff\xff\xff\x15<\x11\x00h;\xc7\x89\x85<\xff\xff\xff\x0f\x84\xd2\xfe\xff\xffWWWj\x04P\xff\x158\x11\x00h;\xc7\x89\x85L\xff\xff\xff\x0f\x84\xb8\xfe\xff\xff\x8b\x00\x83\xf8\x02\x89\x03\x0f\x85\x1c\x02\x00\x00\x83{ \x00\x8b\x85L\xff\xff\xff\x8dS\x04j\x07\x8dp\x04Y\x8b\xfa\xf3\xa5t\x14\x83:\x00t\x0f\xc7\x85P\xff\xff\xff"\x00 \x80\xe9\xef\x01\x00\x00\x8bH \x8b@$\xffs\x08\x89\x8d4\xff\xff\xff\x89\x858\xff\xff\xff\xe8\xa6\xe0\xff\xff\x85\xc0\x89C@\x0f\x84q\x01\x00\x00\x8bK\x08\x8b\xb5L\xff\xff\xff\x8b\xf8\x8b\xc1\xc1\xe9\x02\x83\xc6(\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bs\x08\xffs\x1c\x83\xc6(\x89\xb5P\xff\xff\xff\xe8k\xe0\xff FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x83\xf8\x05\x0f\x85h\x01\x00\x00C\xeb\xc3\xff\xb5\xa8\xfd\xff\xff\xff\x15\xc0\x11\x00h\x83\x8d\xa8\xfd\xff\xff\xff\x83\xa6\x04\x01\x00\x00\x00\x89\x9e\x08\x01\x00\x00i\xdb\x05\x01\x00\x00S\xc7\x86\x00\x01\x00\x00\x05\x01\x00\x00\xe8*\xd1\xff\xff\x85\xc0\x89\x86\x0c\x01\x00\x00u\x08j\x08[\xe9\x1f\x01\x00\x003\xc0PP\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xffP\xf3\xab\x8d\x8d\xac\xfd\xff\xffQP\xff\xb5\x98\xfd\xff\xff\xff\x15$\x11\x00h\x83\xf8\xff\x89\x85\xa8\xfd\xff\xff\x0f\x84\x00\xff\xff\xff\x8b\x1dD\x11\x00h\x8d\x8d\xac\xfd\xff\xffQP\xff\xd3\x85\xc0t"3\xc0\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xff\xf3\xab\x8d\x85\xac\xfd\xff\xffP\xff\xb5\xa8\xfd\xff\xff\xff\xd3\x85\xc0u\x0e\xff\x15\xc8\x11\x00h\x83\xf8\x12\xe9\xc5\xfe\xff\xff\x83\xa5\x9c\xfd\xff\xff\x00\x83\xbe\x08\x01\x00\x00\x00\x8b\xbe\x0c\x01\x00\x00\x0f\x86\x86\x00\x00\x00\x8d\x85\xa0\xfd\xff\xffPW\xff\xb5\xa4\xfd\xff\xff\x8d\x85\xd8\xfd\xff\xffPj\x01\xc7\x85 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => W\xe8\x13\xfc\xff\xff\x85\xc0u:\x8dE\xfcP\x8dE\xf8PVh\xe4\x1a\x03hha\x1d\x00\x00W\xe8\xf6\xfb\xff\xff\x85\xc0u\x1d\x8dE\xfcP\x8dE\xf8PVh\x04\x1b\x03hhb\x1d\x00\x00W\xe8\xd9\xfb\xff\xff\x85\xc0t*\x8b\xf0\xa1\xa8\x1a\x03h\x85\xc0t
P\xe8Z\xc1\xff\xff\x83%\xa8\x1a\x03h\x00\x85\xfft\x07W\xff\x15\xa4\x11\x00h\x8b\xc6\xe9\x92\x00\x00\x00\xa1\xa8\x1a\x03h\x01\x05\xbc\x1a\x03h\x01\x05\xc0\x1a\x03h\x01\x05\xc4\x1a\x03h\x01\x05\xb0\x1a\x03h\x01\x05\xb4\x1a\x03h\x01\x05\xb8\x1a\x03h\x01\x05\xd4\x1a\x03h\x01\x05\xd8\x1a\x03h\x01\x05\xc8\x1a\x03h\x01\x05\xcc\x1a\x03h\x01\x05\xd0\x1a\x03h\x01\x05\xe0\x1a\x03h\x01\x05\xf4\x1a\x03h\x01\x05\xfc\x1a\x03h\x01\x05\xf8\x1a\x03h\x01\x05\x00\x1b\x03h\x01\x05\xdc\x1a\x03h\x01\x05\xf0\x1a\x03h\x01\x05\xec\x1a\x03h\x01\x05\xe8\x1a\x03h\x01\x05\xe4\x1a\x03h\x01\x05\x04\x1b\x03hW\xff\x15\xa4\x11\x00h3\xc0 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x11\x00h3\xff\xe9\x88\x00\x00\x003\xc0\x8dM\xfc@QPS\x89E\xf4\xff\xd6P\xff\xd7\x85\xc0t]3\xc0\x8d}\xd8\xab\xab\xab\xab3\xc0\x8d}\xc8\xab\xab\xab\xab\x8dE\xe8Ph c\x00hj\x00\xff\x15p\x10\x00h\x85\xc0t6\x8bE\xe8\x89E\xdc\x8bE\xec\x89E\xe0\x8dE\xf0P\x8dE\xc8Pj\x10\x8dE\xd8Pj\x00\xffu\xfc\xc7E\xd8\x01\x00\x00\x00\xc7E\xe4\x02\x00\x00\x00\xff\x15\x80\x10\x00h\x89E\xf83\xff\xffu\x1c\xffu\x18\xffu\x14\xffu\x10\xffu\x0c\xe8\xc3\xe6\xff\xff9}\x08\x8b\xf0t\x179}\xf8t\x12WWj\x10\x8dE\xc8PW\xffu\xfc\xff\x15\x80\x10\x00h9}\xfct \xffu\xfc\xff\x15\x04\x11\x00h9}\xf4t\x06\xff\x15X\x10\x00h_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQV\x8b5\x08\x1b\x03hWV\x89u\xfc\xe8\x88\xaf\xff\xff\x8b\xf8\x85\xff\x0f\x85\x02\x01\x00\x009F \x0f\x84\xf1\x00\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xc0\x0f\x84\xd2\xfc\xff\xff3\xf6F\x83}\xb4\x00\x0f\x85\xfd\x01\x00\x00\x8bM\xb0\x8dA\x019E\xd4\x0f\x84\xee\x01\x00\x009M\xd4\xffu\x10\x0f\x85\xd8\x01\x00\x00\x8dE\xb8P\xffu\xe4\xffu\x0c\xffu\x08\xe8]-\x00\x00\x8b\xf0\x85\xf6\x0f\x84\xe3\x01\x00\x00\x83}\xb8\x01uj\xffu\x10\x8dE\xbcP\x8bE\xcc\xff0\xffu\x0c\xffu\x08\xffu\xc8\xffs \xe8\x07\xf9\xff\xff\x8b\xf0\x85\xf6\x0f\x84\xb6\x01\x00\x00\x83}\xbc\x00u=\xffu\x10\xffu\x0c\xffwT\xffu\x08\xe8G+\x00\x00\x85\xc0\x0f\x84B\xfc\xff\xff\xffu\x10\x8dE\xacPj\x01j\x08\xffwT\xffu\x0c\xffu\x08\xe8&7\x00\x00\x85\xc0\x0f\x84!\xfc\xff\xff3\xf6F\x83}\xac\x00\x0f\x84\xe8\xfe\xff\xff\xffE\xfc\x83E\xd0\x04\x83E\xdc\x08\x83E\xcc\x04\x83}\xfc\x01\x0f\x86\x18\xfc\xff\xff\x83e\xfc\x00\x8dG<\x89E\x08\x8dC0\x89E\xcc\x8dC8\x89E\xd0\xffu\x10\x8bE\x08\xffu\xd0j\x01\xff FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xd0\x8b\xd9\x83\xe0\x1f\xc1\xea\x05\xc1\xee\x05;\xc3\x89]\xfcr\x1b\x8dK\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xc8\x8bE\x08\x8b\x14\x90+\xcb\xd3\xea\xeb\x19\x8dH\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xcb+\xc8\x8bE\x08\x8b\x14\x90\xd3\xe2j Y+M\x18\x83\xc8\xff\xd3\xe0j\x1fY+M\xfc\xd3\xe8\x8bM\x10\x8d\x0c\xb1\x8b\xf0\xf7\xd6#1#\xc2\x0b\xf0+}\x18\x891\x0f\x85w\xff\xff\xff^[3\xc0@_\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecVW\xffu\x0c\x8b}\x08W\xe8\xbe\xfd\xff\xff\x8b\xf0\x85\xf6t\x0f\xfft\xb7\xfc\xe8Z\xfe\xff\xffN\xc1\xe6\x05\x03\xc6_^]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xc93\xf69M\x0ct\x0e\x8bE\x089\x0c\xb0u\x18F;u\x0cu\xf5\xffu\x10Qj\x11\xe8\\xb7\xfe\xff3\xc0^]\xc2\x0c\x00\xff4\xb0\xe8M\xfe\xff\xff\xc1\xe6\x05\x03\xc6\xeb\xec\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQ FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xfc\x839\x00u\x08N\x83\xe9\x04\x85\xf6u\xf3\x8dD\x18\xfc\x838\x00u\x08J\x83\xe8\x04\x85\xd2u\xf3\xffu0\x8b]\xe4\x8dE\x80P\xffu,\x89u\xe8\x8bu\xe0SV\x8dE\x90P\x89U\xec\xe8\x89'\x00\x00\x85\xc0\x0f\x84 \x01\x00\x00\x8bM\x803\xffG\x85\xc9u 9M\x84\x0f\x84\x00\xfc\xff\xff\x8bE,;E\x14\x0f\x83\xf1\x00\x00\x00\x89\x0c\x86\x8bE,\x8bM\x84\x89\x0c\x83\xe94\xfe\xff\xff\x8b}\xf4\x8bU\xb4\xc1\xe7\x02\xc1\xe2\x02\x8bD\x15\xe8\x8bL\x15\xe0\x8dt=\xe8\x8b\x1e+\xd8\x89E\xfc\x8bE,C\x89M\xb4\xe8\xcb\xf6\xff\xff\xffu0\x89E\xf8\xffu\xd4\x8bD=\xd8\xffu\xd0j\x00\xffu\xfc\xfft\x15\xd8\xff6P\xe8\xa1\x11\x00\x00\x85\xc0\x0f\x84\x85\x00\x00\x00\x8bM\xd0\x8b\xc3\xe8\x98\xf6\xff\xff\x8bM\xd4\x8b\xd8\x8bE\xfc\xe8\x8b\xf6\xff\xff\x89\x06\xc1\xe0\x02P\xffu\xd4\xfft=\xd8\xe8\xe1<\x00\x00\x83\xc4\x0c\xffu0\xffu\xd4\xffu FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x01\x00\x00\x8dt\x9e\xfc\x8b\x06;\xc1\x89u\xe8\x0f\x84\xff\x00\x00\x00P\x89M\xfc\x89M\xec\xe8\xe0\xde\xff\xff\x8b>j Y+\xc8\x83\xfb\x02\x89M\xf8r \x8bE\x08\x8bt\x98\xf8\xeb\x023\xf6\x83\xfb\x03r \x8bE\x08\x8bT\x98\xf4\xeb\x023\xd2j\x1f[\xffu\x14+\xd9\x83e\xf4\x00\x8b\xc6\xd1\xe8\x8b\xcb\xd3\xe8\x8bM\xf8\xd3\xe7\xd1\xea\x8b\xcb\xd3\xea\x8bM\xf8\xd3\xe6\x0b\xc7\x8d}\xecW\x0b\xd6\x8b\xf2\x83\xcb\xff\x8d}\xfcW\x8b\xd3P+\xd0\x8b\xcb+\xceRQ\xe8\xa8\xfe\xff\xff\x85\xc0t9\x8bE\xfc\xf7\xe6;U\xec\xc7E\xf4\x01\x00\x00\x00\x89E\xe0v\x03\xffM\xfc\x8bM\xf8\x8bE\xe8\x8b}\x0c\x8b\xf3\xd3\xee+0O;u\xfcsD\x85\xffv\x0f\x8bE\x08\x8bD\xb8\xfc\xeb\x08\x83e\xf4\x00\xebW3\xc0\x8bU\x08\x83e\xe4\x00\x8b\xcb+\xc8\x8bE\xfc\xf7$\xba;\xd6w\x17r\x04;\xc1w\x11+\xc8\x1b\xf2\x89u\xe4\x8b\xf1u \x85\xffu\xbb\xeb\x03 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xfb\xcb\x0f\xd4\xc1\x0f\x7f\xc1\x0f\x7f\xd3\x0f\xdb\xcb\x0f\x7f \x83\xc1\x10O\x0fs\xd0 \x0f\x7f\xc1u\xd19S\x0c\x0f\xef\xc0\x0f\x7f\xc3\x0f\xfb\xd9\x0f\x7f\xd9\x0f\xdf\xcat.\x8bK\x08+\xf1\x0fo\x14\x0e\x0f\xd4\xc2\x0fo\x11\x0f\x7f\xcb\x0f\xdb\xd3\x0f\xd4\xc2\x0f\x7f\xc2\x0f~\xd7\x89<\x90B\x83\xc1\x10;S\x0c\x0fs\xd0 u\xd7\x0fw3\xc0_@^\x8b\xe5]\x8b\xe3[\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffS\x8b\xdcQQ\x83\xe4\xf0\x83\xc4\x04U\x8bk\x04\x89l$\x04\x8b\xec\x83\xec8\x8bC\x10\x8bK\x18\x83e\xec\x00\x83M\xe8\xff\x83e\xe4\x00\x83M\xe0\xfff\x0foU\xe0\x89E\xd0\x8bC\x14V\x8b0W\x8bx \x8b@\x1c\x89E\xdc\x8bC\x08\x8b\x10\x0f\xafU\xdc\x83\xc1\x0f\x8b\xc6\x83\xe1\xf0\xc1\xe0\x04\x03\xc1\x85\xf6\x89U\xc8\x89E\xd4tY\x8bS\x08+\xd7\x89E\xf8)M\xf8f\x0f\xef\xc0\x89M\xd8\x89}\xfc\x89U\xcc\x89u\xf4\xeb\x03\x8bU\xcc\x8b}\xfc FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \xff\x85\xf6t\x08\x8b\xc8\x8b\xc2\x8b\xd1\x8b\xce\x83e\x14\x00\x85\xd2_u\x0f\x8bU\x18\x8bu\xfc\x89\x02\x89J\x04\xebh\xd1\xea\x8b\xda\xf7\xd3\xf6\xc3\x01u\xf5\xeb1;\xc2\x1b\xf6\xf7\xde+\xce+\xc2\xeb
\x8b\xf1\xc1\xe6\x1e\xc1\xe8\x02\x0b\xc6\xc1\xe9\x02\xa8\x03t\xef\x8b\xd8\xf7\xd3\xf6\xc3\x01t\x0b\x8b\xf1\xc1\xe6\x1f\xd1\xe8\x0b\xc6\xd1\xe9\x85\xc9u\xcb\xffu\x1c\x8dM\x14QRP\xe8
\xfe\xff\xff3\xf6\x85\xc0t\x12\x8bE\x14\x83e\x14\x00\x8bM\x18F3\xd2\x89\x01\x89Q\x04\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x10SVW\xffu\x1c\xffu\x10\xffu\x0c\xe8\xd3\xbf\xff\xff\x8bu\x18\x8b\x1e\xffu\x1c\x8bN\x08\x89E\xf8\x8b\xc3\xc1\xe0\x02j\x00\x03\xc8Q\x89E\xf0\xe8 \xc6\xff\xff\x8b\xf8\x85\xff\x89}\xfcu\x073\xdb\xe9\xbc\x01\x00\x00\x83}\xf8\x00\xffu\x1c\xff6u\x1d\xffv \x8bF,\xffu\x14PP\xe8\xf8\xb3\xff\xff\x8b\xd8\xf7\xdb FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => Data\x002\x00\x00CryptUnprotectData\x00d\x00\x00SHGetFolderPathW\x002\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xe0\x02\x00\xe0\x11\x00\x00\x10\xdf\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00N\xe3\x02\x00\xd4\x10\x00\x00<\xde\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00j\xe4\x02\x00\x00\x10\x00\x00T\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xe7\x02\x00\x18\x12\x00\x00\x0c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00D\xe7\x02\x00\xd0\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xea\x02\x00\x00\xea\x02\x00\xe0\xe9\x02\x00\xc2\xe9\x02\x00\xa6\xe9\x02\x00\x8a\xe9\x02\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00FL\x01h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00J\xdd\xa2,y\xe8!\x05\xd4\x13\x00h\xc0\x13\x00h\xbc\x13\x00h\xa8\x13\x00h\x94\x13\x00h\xbc\x13\x00h\x80\x13\x00hl\x13\x00h\xbc\x13\x00hX\x13\x00hH\x13\x00h FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => m (SHA-1)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 2 (MD2)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 4 (MD4)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Dige FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00RSA Data Security's RC4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01f\x00\x008\x00\x00\x008\x00\x00\x008\x00\x00\x00\x0f\x00\x00\x00\x04\x00\x00\x00DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00Data Encryption Standard (DES)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 f\x00\x00p\x00\x00\x00p\x00\x00\x00p\x00\x00\x00\x0f\x00\x00\x00
\x00\x00\x003DES TWO KEY\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Two Key Triple DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03f\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\x0f\x00\x00\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => \xd0\x10\x03\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtSetInformationFile |
FileHandle => 0x00000270 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x00\x01\x00\x00P\x01\x00\x00\x1c\x86V\xe4\x80\xb9\x0fs\x00\x007\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00o\x00p\x00e\x00n\x00 \x00s\x00i\x00g\x00n\x00a\x00t\x00u\x00r\x00e\x00 \x00f\x00i\x00l\x00e\x00?\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00g\x00e\x00t\x00 \x00t\x00h\x00e\x00 \x00s\x00i\x00z\x00e\x00 \x00o\x00f\x00 \x00R\x00s\x00a\x00b\x00a\x00s\x00e\x00.\x00s\x00i\x00 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,411 | 1660 | NtReadFile |
Buffer => \x07:\x0e:\x18:%:t:\x81:\x8f:\x9f:\xad:\xbb:\xc9:\xda:\xe8:\xf6:\x04;\x12; ;2;C;Q;\xa0;\xdb;\xe5;\xef;\xf9;\x10<\x17<'<4<M<T<a<l<~<\x85<\x8f<\x99<\xda<\xe7<\xf7<\x01=\x18=\x1f=/=:=Q=X=h=s=\x85=\x8c=\x96=\xa3=\xde=\xeb=\xfb=\x05>\x1c>#>3>>>R>Y>i>t>\x86>\x8d>\x97>\xa4>\xdf>\xe9>\xf9>\x03?\x17?$?4???S?Z?j?u?\x87?\x8e?\x98?\xa3?\xdc?\xe6?\xf6?\x00\x80\x01\x00\xe4\x01\x00\x00\x000\x170\x1e0.090L0W0g0r0\x840\x8b0\x950\xa20\xee0\xfa0\x081\x1e1(181F1W1d1t1\x821\x901\xa21\xaf1\xbd1\xcb102k2u2\x7f2\x892\xa02\xa72 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrLoadDll |
Flags => 33291232 BaseAddress => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | RegOpenKeyExA |
Handle => 0x00000270 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | RegQueryValueExA |
Handle => 0x00000270 DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | RegQueryValueExA |
Handle => 0x00000270 Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | RegCloseKey |
Handle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrLoadDll |
Flags => 33291008 BaseAddress => 0x77fe0000 FileName => Secur32.dll |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserNameExA FunctionAddress => 0x77fe1dca ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:26,492 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:15:26,492 | 1660 | RegCloseKey |
Handle => 0x0000026c |
SUCCESS | 0x00000000 | |
| 09:15:26,932 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:26,942 | 1660 | LdrLoadDll |
Flags => 33291280 BaseAddress => 0x77a80000 FileName => CRYPT32.dll |
SUCCESS | 0x00000000 | |
| 09:15:26,942 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptProtectData FunctionAddress => 0x77a8b942 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:26,962 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,972 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:26,972 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,972 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,972 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,972 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:26,972 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,982 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:26,982 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,992 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,992 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,992 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,992 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:26,992 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,002 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,002 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,002 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,002 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,002 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,002 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,002 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,002 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,002 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,012 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,012 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,012 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,012 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,012 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,012 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,012 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,012 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,012 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,022 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,022 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,022 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,022 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,022 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,022 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,022 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,022 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,022 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,032 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,032 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,032 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,032 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,032 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,032 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,032 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,032 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,032 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,032 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,032 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,032 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,042 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,042 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,042 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,042 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,042 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,042 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,042 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000280 FileInformation => \xe0\x13FW\x8a\xa2\xcf\x01\xe0\x13FW\x8a\xa2\xcf\x01\xe0\x13FW\x8a\xa2\xcf\x01\xe0\x13FW\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00>L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:27,042 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,052 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,052 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,052 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,052 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,052 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,052 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,052 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,052 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,052 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,062 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,062 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,062 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,062 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,062 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,062 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,062 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,062 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,062 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,062 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,072 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,072 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,072 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,072 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,072 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdr.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,072 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,072 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000280 FileInformation => p\xa9JW\x8a\xa2\xcf\x01p\xa9JW\x8a\xa2\xcf\x01p\xa9JW\x8a\xa2\xcf\x01p\xa9JW\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00?L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb2\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:27,092 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,092 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,092 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,092 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,092 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,092 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,143 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,143 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,143 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,143 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,143 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,143 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,173 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,173 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x0023b5a8 | |
| 09:15:27,223 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdri.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000280 FileInformation => @\x95aW\x8a\xa2\xcf\x01@\x95aW\x8a\xa2\xcf\x01@\x95aW\x8a\xa2\xcf\x01@\x95aW\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:27,223 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000280 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000280 SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:15:27,223 | 1660 | RegOpenKeyExA |
Handle => 0x00000280 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | RegQueryValueExA |
Handle => 0x00000280 DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | RegQueryValueExA |
Handle => 0x00000280 Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | RegCloseKey |
Handle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | RegOpenKeyExA |
Handle => 0x00000280 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | RegQueryValueExA |
Handle => 0x00000280 Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | RegQueryValueExA |
Handle => 0x00000280 DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | RegQueryValueExA |
Handle => 0x00000280 Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,223 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | RegOpenKeyExA |
Handle => 0x0000027c Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | RegQueryValueExA |
Handle => 0x0000027c DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | RegQueryValueExA |
Handle => 0x0000027c Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:15:27,233 | 1660 | RegCloseKey |
Handle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002469a8 | |
| 09:15:27,233 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000027c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000280 FileInformation => \xe0\x13FW\x8a\xa2\xcf\x01\xe0\x13FW\x8a\xa2\xcf\x01\xe0\x13FW\x8a\xa2\xcf\x01\xe0\x13FW\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00\xb4\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00>L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:27,233 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptUnprotectData FunctionAddress => 0x77a8baf0 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:27,233 | 1660 | NtDeviceIoControlFile |
InputBuffer => B5B780E97FBC8C22B061C29921AB0D7C\x00\x07\x07\x07\x07\x07\x07\x07 FileHandle => 0x00000090 OutputBuffer => B5B780E97FBC8C22B061C29921AB0D7C\x00\x07\x07\x07\x07\x07\x07\x07 |
SUCCESS | 0x00000000 | |
| 09:15:32,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,120 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,120 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,120 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,120 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,130 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,130 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:32,130 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,130 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,470 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,470 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,470 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:32,470 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:32,470 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,470 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,480 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:32,480 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,480 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,480 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:32,480 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:32,480 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,490 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,490 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:32,941 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,941 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,941 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:32,941 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:32,941 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,951 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,951 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:32,951 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,951 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,951 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:32,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:32,961 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,961 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,961 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:32,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:32,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:32,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:32,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:32,971 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:32,971 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:32,971 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:33,001 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:33,001 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:33,001 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:33,001 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:33,011 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:33,011 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,011 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:33,011 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0023b5a8 | |
| 09:15:33,011 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x0023b5a8 | |
| 09:15:33,011 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x0023b5a8 | |
| 09:15:33,011 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x0023b5a8 | |
| 09:15:33,011 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:33,011 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,021 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:33,021 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:33,021 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:33,021 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:33,021 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:33,021 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:33,021 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,021 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:33,031 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002469a8 | |
| 09:15:33,031 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002469a8 | |
| 09:15:33,031 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002469a8 | |
| 09:15:33,031 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002469a8 | |
| 09:15:33,031 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:33,031 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000280 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,031 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000027c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:33,301 | 1660 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | RegQueryValueExW |
Handle => 0x0000027c Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | LdrGetProcedureAddress |
Ordinal => 43 FunctionName => FunctionAddress => 0x7ca23a9d ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => ShellExecuteExW FunctionAddress => 0x7ca02f03 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitializeEx FunctionAddress => 0x774fef7b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | RegOpenKeyExA |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 520 ValueName => MaximizeApps Type => 33290608 |
FAILURE | 0x00000002 | |
| 09:15:33,301 | 1660 | RegOpenKeyExA |
Handle => 0x00000280 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | RegQueryValueExW |
Handle => 0x00000280 DataLength => 520 ValueName => MaximizeApps Type => 33290608 |
FAILURE | 0x00000002 | |
| 09:15:33,301 | 1660 | RegCloseKey |
Handle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:33,301 | 1660 | LdrLoadDll |
Flags => 33290920 BaseAddress => 0x5b860000 FileName => netapi32 |
SUCCESS | 0x00000000 | |
| 09:15:33,331 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetGetJoinInformation FunctionAddress => 0x5b869b54 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:33,331 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\wkssvc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:33,331 | 1660 | NtSetInformationFile |
FileHandle => 0x00000280 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:15:33,331 | 1660 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00\x98\xd0\xffk\x12\xa1\x106\x983F\xc3\xf8~4Z\x01\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000280 |
SUCCESS | 0x00000000 | |
| 09:15:33,331 | 1660 | NtReadFile |
Buffer => FileHandle => 0x00000280 |
SUCCESS | 0x00000103 | |
| 09:15:33,351 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x5b860000 FileName => netapi32 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetApiBufferFree FunctionAddress => 0x5b867a00 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000282 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegEnumKeyW |
Handle => 0x00000282 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x0000027e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x0000027e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x0000027e |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegEnumKeyW |
Handle => 0x00000282 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000282 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrLoadDll |
Flags => 33288956 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrGetProcedureAddress |
Ordinal => 102 FunctionName => FunctionAddress => 0x7c9ef5e2 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrLoadDll |
Flags => 33288996 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemAlloc FunctionAddress => 0x774fd060 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrGetProcedureAddress |
Ordinal => 320 FunctionName => FunctionAddress => 0x773e0a75 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrGetProcedureAddress |
Ordinal => 324 FunctionName => FunctionAddress => 0x773e0c22 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrGetProcedureAddress |
Ordinal => 323 FunctionName => FunctionAddress => 0x773e0b17 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000280 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x00000280 SubKey => FileExts |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000027c SubKey => .exe |
FAILURE | 0x00000002 | 1 time |
| 09:15:33,351 | 1660 | LdrGetProcedureAddress |
Ordinal => 326 FunctionName => FunctionAddress => 0x773e0cc1 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000286 Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000286 Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x0000028a Registry => 0x80000000 SubKey => exefile |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000028a SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x0000028e Registry => 0x0000028a SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x0000028a |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => DontShowSuperHidden Type => 33288660 |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x00000280 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 36 ValueName => ShellState Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => ValueName => ShellState |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => ForceActiveDesktopOn Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => NoActiveDesktop Type => 33287988 |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | GetSystemMetrics |
SystemMetricIndex => 4096 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\System |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | GetSystemMetrics |
SystemMetricIndex => 4096 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => NoWebView Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => ClassicShell Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => SeparateProcess Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,351 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => NoNetCrawling Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:33,351 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,361 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => NoSimpleStartMenu Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:33,361 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegOpenKeyExW |
Handle => 0x00000288 Registry => 0x00000280 SubKey => Advanced |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 2 ValueName => Hidden |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 1 ValueName => ShowCompColor |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 1 ValueName => HideFileExt |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 0 ValueName => DontPrettyPath |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 1 ValueName => ShowInfoTip |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 0 ValueName => HideIcons |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 0 ValueName => MapNetDrvBtn |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 1 ValueName => WebView |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 0 ValueName => Filter |
SUCCESS | 0x00000000 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => ShowSuperHidden Type => 33289160 |
FAILURE | 0x00000002 | |
| 09:15:33,361 | 1660 | RegQueryValueExW |
Handle => 0x00000288 Data => 0 ValueName => SeparateProcess |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | RegQueryValueExW |
Handle => 0x00000288 DataLength => 4 ValueName => NoNetCrawling Type => 33289160 |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegCloseKey |
Handle => 0x00000288 |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000028e SubKey => ShellEx\IconHandler |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => SystemFileAssociations\.exe |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => SystemFileAssociations\application |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegQueryValueExW |
Handle => 0x0000028e DataLength => 0 ValueName => DocObject Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegQueryValueExW |
Handle => 0x0000028e DataLength => 0 ValueName => BrowseInPlace Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000028e SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegOpenKeyExW |
Handle => 0x00000292 Registry => 0x80000000 SubKey => * |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000292 SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegQueryValueExW |
Handle => 0x0000028e DataLength => 0 ValueName => IsShortcut Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegQueryValueExW |
Handle => 0x0000028e DataLength => 0 ValueName => AlwaysShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | RegQueryValueExW |
Handle => 0x0000028e DataLength => 0 ValueName => NeverShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,371 | 1660 | LdrGetProcedureAddress |
Ordinal => 388 FunctionName => FunctionAddress => 0x773e1535 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | RegCloseKey |
Handle => 0x00000286 |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | RegCloseKey |
Handle => 0x0000028e |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | RegCloseKey |
Handle => 0x00000292 |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | LdrGetProcedureAddress |
Ordinal => 328 FunctionName => FunctionAddress => 0x773e1559 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,371 | 1660 | LdrLoadDll |
Flags => 33289120 BaseAddress => 0x77920000 FileName => SETUPAPI.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,381 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CM_Get_Device_Interface_List_Size_ExW FunctionAddress => 0x77929025 ModuleHandle => 0x77920000 |
SUCCESS | 0x00000000 | |
| 09:15:33,381 | 1660 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeLoadDriverPrivilege |
SUCCESS | 0x00000001 | |
| 09:15:33,381 | 1660 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeUndockPrivilege |
SUCCESS | 0x00000001 | |
| 09:15:33,381 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CM_Get_Device_Interface_List_ExW FunctionAddress => 0x7792a15c ModuleHandle => 0x77920000 |
SUCCESS | 0x00000000 | |
| 09:15:33,381 | 1660 | NtOpenFile |
ShareAccess => 3 FileName => IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} DesiredAccess => 0x00100080 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:33,381 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x1c\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 IoControlCode => 5046280 InBuffer => |
SUCCESS | 0x00000001 | |
| 09:15:33,381 | 1660 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \x00\x00\x00\x00\x84\xf1\xfb\x01x \x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xdc\xf1\xfb\x01\xe4\xf3\xfb\x01\xe4\xf3\xfb\x01D\xf0\xfb\x01\x18\x00\x00\x00\x00\x00\x00\x00h\xef\xfb\x01@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb0\xff$\x00h\xdb\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00 |
FAILURE | 3221225508 | |
| 09:15:33,381 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,381 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \xea\x01\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 |
FAILURE | 0x00000000 | |
| 09:15:33,381 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \xea\x01\x00\x00\x02\x00\x00\x00n\x01\x00\x00`\x00\x00\x008\x00\x00\x00\x1a\x01\x00\x00R\x01\x00\x00\x1c\x00v\x00\xce\x01\x00\x00\x1c\x00\\x008\x00\x00\x00\x1a\x01o\x00R\x01\x00\x00\x1c\x00\x00\x00\\x00?\x00?\x00\\x00I\x00D\x00E\x00#\x00C\x00d\x00R\x00o\x00m\x00V\x00B\x00O\x00X\x00_\x00C\x00D\x00-\x00R\x00O\x00M\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x001\x00.\x000\x00_\x00_\x00_\x00_\x00_\x00#\x004\x002\x005\x006\x002\x00d\x003\x002\x003\x001\x003\x000\x003\x000\x003\x007\x003\x003\x003\x000\x003\x006\x003\x007\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 |
SUCCESS | 0x00000001 | |
| 09:15:33,392 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x000002a8 SubKey => {e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegQueryValueExW |
Handle => 0x000002ac Data => ValueName => Data |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x000002ac SubKey => {e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegQueryValueExW |
Handle => 0x000002a8 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | LdrGetProcedureAddress |
Ordinal => 334 FunctionName => FunctionAddress => 0x773e0f5a ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | NtOpenFile |
ShareAccess => 3 FileName => STORAGE#Volume#1&30a96598&0&SignatureC7EDC7EDOffset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} DesiredAccess => 0x00100080 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:33,392 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => .\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 IoControlCode => 5046280 InBuffer => |
SUCCESS | 0x00000001 | |
| 09:15:33,392 | 1660 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \x00\x00\x00\x00\x84\xf1\xfb\x01x \x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xdc\xf1\xfb\x01\xe4\xf3\xfb\x01\xe4\xf3\xfb\x01S\x00o\x00\x18\x00\x00\x00\x00\x00\x00\x00h\xef\xfb\x01@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\xff$\x00\xc8L \x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00 |
FAILURE | 3221225508 | |
| 09:15:33,392 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \xee\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 |
FAILURE | 0x00000000 | |
| 09:15:33,392 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \xee\x00\x00\x00\x02\x00\x00\x00r\x00\x00\x00`\x00\x00\x008\x00\x00\x00\x0c\x00\x00\x00D\x00\x00\x00.\x00v\x00\xd2\x00\x00\x00\x1c\x00\\x008\x00\x00\x00\x0c\x00d\x00D\x00\x00\x00.\x00k\x00\xed\xc7\xed\xc7\x00~\x00\x00\x00\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\\x00D\x00o\x00s\x00D\x00e\x00v\x00i\x00c\x00e\x00s\x00\\x00C\x00:\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 |
SUCCESS | 0x00000001 | |
| 09:15:33,392 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x000002a8 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegQueryValueExW |
Handle => 0x000002ac Data => ValueName => Data |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x000002ac SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,392 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | RegQueryValueExW |
Handle => 0x000002a8 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | LdrGetProcedureAddress |
Ordinal => 332 FunctionName => FunctionAddress => 0x773e0df4 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => |
FAILURE | 3221225508 | |
| 09:15:33,402 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:15:33,402 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x08\x00\x00\x00C\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:33,402 | 1660 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \xbb\x01\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\xe0\xd2\x1e\x00\xfc\x0c\x82|\x80\xb6#\x00b\x00d\x00\xd8\x9b\x18\x00h\xfc\xfb\x01\xc0\x9a\x83|\xc0\xf4\xfb\x01\x18\x0e\xa0|\xd8\x9b\x18\x00\x80\xb6#\x00\x05\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x001L\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x001L\x00\x001L\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff1L\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xc0j$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:15:33,402 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:15:33,402 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x08\x00\x00\x00C\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:33,402 | 1660 | RegCreateKeyExW |
Handle => 0x000002a8 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | RegSetValueExW |
Handle => 0x000002a8 Buffer => D\x00r\x00i\x00v\x00e\x00\x00\x00 ValueName => BaseClass Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => @\x00\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x10\xd2\x1e\x00\xfc\x0c\x82|\x80\xb6#\x00b\x00d\x00h\x9b\x18\x00\x80\xb6#\x00h\xfc\xfb\x01\xc0\xf4\xfb\x01\xde \xa0|h\x9b\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x001L\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x001L\x00\x001L\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff1L\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xc0j$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:15:33,402 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:15:33,402 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x08\x00\x00\x00D\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:33,402 | 1660 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \xbb\x01\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x10\xd2\x1e\x00\xfc\x0c\x82|\x80\xb6#\x00b\x00d\x00h\x9b\x18\x00h\xfc\xfb\x01\xc0\x9a\x83|\xc0\xf4\xfb\x01\x18\x0e\xa0|h\x9b\x18\x00\x80\xb6#\x00\x05\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x001L\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x001L\x00\x001L\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff1L\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xc0j$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:15:33,402 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,402 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:15:33,402 | 1660 | DeviceIoControl |
DeviceHandle => 0x000002a8 OutBuffer => \x08\x00\x00\x00D\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:33,402 | 1660 | RegCreateKeyExW |
Handle => 0x000002a8 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegSetValueExW |
Handle => 0x000002a8 Buffer => D\x00r\x00i\x00v\x00e\x00\x00\x00 ValueName => BaseClass Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x000002a8 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegQueryValueExW |
Handle => 0x000002ac Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246af8 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x000002ae Registry => 0x80000000 SubKey => Directory |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002ae SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x000002ae SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegCloseKey |
Handle => 0x000002ae |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002aa SubKey => ShellEx\IconHandler |
FAILURE | 0x00000002 | |
| 09:15:33,412 | 1660 | RegQueryValueExW |
Handle => 0x000002aa DataLength => 0 ValueName => DocObject Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,412 | 1660 | RegQueryValueExW |
Handle => 0x000002aa DataLength => 0 ValueName => BrowseInPlace Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002aa SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x000002ae Registry => 0x80000000 SubKey => Folder |
SUCCESS | 0x00000000 | |
| 09:15:33,412 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002ae SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:15:33,422 | 1660 | RegQueryValueExW |
Handle => 0x000002aa DataLength => 0 ValueName => IsShortcut Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,422 | 1660 | RegQueryValueExW |
Handle => 0x000002aa DataLength => 2 ValueName => AlwaysShowExt Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,422 | 1660 | RegQueryValueExW |
Handle => 0x000002aa DataLength => 0 ValueName => NeverShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,422 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,422 | 1660 | RegCloseKey |
Handle => 0x000002ae |
SUCCESS | 0x00000000 | |
| 09:15:33,422 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246af8 | |
| 09:15:33,422 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\My Documents |
SUCCESS | 0x00246af8 | |
| 09:15:33,422 | 1660 | LdrGetProcedureAddress |
Ordinal => 66 FunctionName => FunctionAddress => 0x7c9f063c ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,422 | 1660 | LdrGetProcedureAddress |
Ordinal => 100 FunctionName => FunctionAddress => 0x7c9ec059 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,422 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,422 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,422 | 1660 | RegQueryValueExW |
Handle => 0x000002ac DataLength => 4 ValueName => UseDesktopIniCache Type => 33282048 |
FAILURE | 0x00000002 | |
| 09:15:33,422 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,422 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002ac FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002ac FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002ac FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002ac FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002ac FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,432 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002ac FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoUninitialize FunctionAddress => 0x774fee46 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegCreateKeyExW |
Handle => 0x000002ac Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegQueryValueExW |
Handle => 0x000002ac Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Common Documents |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegCreateKeyExW |
Handle => 0x000002ac Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegSetValueExW |
Handle => 0x000002ac Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Common Documents Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x000002ac SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegQueryValueExW |
Handle => 0x000002a8 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,442 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246b68 | |
| 09:15:33,442 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users |
SUCCESS | 0x00246b68 | |
| 09:15:33,452 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Documents |
SUCCESS | 0x00246b68 | |
| 09:15:33,452 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtQueryInformationFile |
FileHandle => 0x000002a8 FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | RegCreateKeyExW |
Handle => 0x000002a8 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | RegQueryValueExW |
Handle => 0x000002a8 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Desktop |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | RegCreateKeyExW |
Handle => 0x000002a8 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | RegSetValueExW |
Handle => 0x000002a8 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Desktop Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:33,452 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x000002a8 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegQueryValueExW |
Handle => 0x000002ac Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246af8 | |
| 09:15:33,462 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246af8 | |
| 09:15:33,462 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Desktop |
SUCCESS | 0x00246af8 | |
| 09:15:33,462 | 1660 | RegCreateKeyExW |
Handle => 0x000002ac Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegQueryValueExW |
Handle => 0x000002ac Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Common Desktop |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegCreateKeyExW |
Handle => 0x000002ac Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegSetValueExW |
Handle => 0x000002ac Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Common Desktop Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegOpenKeyExW |
Handle => 0x000002ac Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x000002ac SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegCloseKey |
Handle => 0x000002ac |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegQueryValueExW |
Handle => 0x000002a8 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246b68 | |
| 09:15:33,462 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users |
SUCCESS | 0x00246b68 | |
| 09:15:33,462 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Desktop |
SUCCESS | 0x00246b68 | |
| 09:15:33,462 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000002a8 DataLength => 0 ValueName => {AEB6717E-7E19-11d0-97EE-00C04FD91972} Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,462 | 1660 | RegOpenKeyExW |
Handle => 0x000002ae Registry => 0x80000000 SubKey => CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:15:33,472 | 1660 | RegQueryValueExW |
Handle => 0x000002ae Data => s\x00h\x00e\x00l\x00l\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,472 | 1660 | RegQueryValueExW |
Handle => 0x000002ae DataLength => 0 ValueName => LoadWithoutCOM Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegCloseKey |
Handle => 0x000002ae |
SUCCESS | 0x00000000 | |
| 09:15:33,472 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000002a8 DataLength => 0 ValueName => {AEB6717E-7E19-11d0-97EE-00C04FD91972} Type => 33290996 |
FAILURE | 0x00000103 | |
| 09:15:33,472 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:15:33,472 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,472 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .ade |
FAILURE | 0x00000002 | |
| 09:15:33,472 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .adp |
FAILURE | 0x00000002 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .app |
FAILURE | 0x00000002 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .asp |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => a\x00s\x00p\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .bas |
FAILURE | 0x00000002 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .bat |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => b\x00a\x00t\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .cer |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => C\x00E\x00R\x00F\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .chm |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => c\x00h\x00m\x00.\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .cmd |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => c\x00m\x00d\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .com |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => c\x00o\x00m\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .cpl |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => c\x00p\x00l\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002aa Registry => 0x80000000 SubKey => .crt |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002aa Data => C\x00E\x00R\x00F\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002aa |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .csh |
FAILURE | 0x00000002 | |
| 09:15:33,482 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetClassObject FunctionAddress => 0x775156c5 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002a8 Data => 1 ValueName => Com+Enabled |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | LdrLoadDll |
Flags => 33290296 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetCatalogObject FunctionAddress => 0x76fd3f78 ModuleHandle => 0x76fd0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegQueryValueExW |
Handle => 0x000002a8 Data => 1 ValueName => Com+Enabled |
SUCCESS | 0x00000000 | |
| 09:15:33,482 | 1660 | RegCloseKey |
Handle => 0x000002a8 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | LdrLoadDll |
Flags => 33290296 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetCatalogObject2 FunctionAddress => 0x76fd4017 ModuleHandle => 0x76fd0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CLSIDFromOle1Class FunctionAddress => 0x775188b9 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x000002ac ObjectAttributes => \Registry\User\S-1-5-21-1935655697-1606980848-1060284298-1003_Classes |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x000002b4 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002bc ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x000002c4 Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002cc ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x000002d4 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x000002dc Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x000002e4 Registry => 0x80000002 SubKey => Software\Classes\CLSID |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x000002ec Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x000002f4 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002fc ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000304 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x0000030c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000314 Registry => 0x80000002 SubKey => Software\Classes\CLSID |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x0000031c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegQueryValueExW |
Handle => 0x0000031c Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x0000031c |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitializeCriticalSectionAndSpinCount FunctionAddress => 0x7c80b8b9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\Registration\R000000000007.clb DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000031c |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000031c FileInformation => \x00`\x00\x00\x00\x00\x00\x00\xf0W\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | NtSetInformationFile |
FileHandle => 0x0000031c FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:15:33,492 | 1660 | NtReadFile |
Buffer => COM+\x01\x00\x00\x00\x01\x00\x12\x00$\x00\x00\x00\x00\x01\x01\x00c\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x01\x10\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00F\x0e\x00\x00\x000\x01\x00\x00\xa0\x03\x00\x003_0\x00\xd0\x04\x00\x00\x0c\x00\x00\x003_1\x00\xdc\x04\x00\x00\x88\x02\x00\x003_2\x00d\x07\x00\x00<\x00\x00\x003_3\x00\xa0\x07\x00\x00\x90\x08\x00\x003_4\x000\x10\x00\x00(\x00\x00\x003_5\x00X\x10\x00\x00(\x00\x00\x003_6\x00\x80\x10\x00\x00(\x00\x00\x003_7\x00\xa8\x10\x00\x00\x88\x10\x00\x003_8\x000!\x00\x00\xa8 \x00\x003_9\x00\xd8*\x00\x00<\x04\x00\x003_10\x00\x00\x00\x00\x14/\x00\x00\x0c\x01\x00\x003_11\x00\x00\x00\x00 0\x00\x00\x1c\x00\x00\x003_12\x00\x00\x00\x00<0\x00\x00\x14\x00\x00\x003_16\x00\x00\x00\x00P0\x00\x00\x90\x0e\x00\x00#Schema\x00\xe0>\x00\x00 FileHandle => 0x0000031c |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x0000031c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegQueryValueExW |
Handle => 0x0000031c Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x0000031c |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x0000031e Registry => 0x000002ae SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031e SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000322 Registry => 0x000002ae SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x0000031e |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x0000031e Registry => 0x00000322 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000326 Registry => 0x0000031e SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegQueryValueExW |
Handle => 0x00000326 DataLength => 1000 ValueName => InprocServer32 Type => 33316960 |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x00000326 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031e SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031e SubKey => LocalServer32 |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000326 Registry => 0x0000031e SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegQueryValueExW |
Handle => 0x00000326 Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00u\x00r\x00l\x00m\x00o\x00n\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x00000326 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031e SubKey => InprocHandler32 |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031e SubKey => InprocHandlerX86 |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031e SubKey => LocalServer32 |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031e SubKey => LocalServer |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000326 Registry => 0x00000322 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegQueryValueExW |
Handle => 0x00000326 DataLength => 100 ValueName => AppID Type => 33290088 |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x00000326 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x0000031e |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x0000031e Registry => 0x00000322 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000326 Registry => 0x0000031e SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegQueryValueExW |
Handle => 0x00000326 Data => B\x00o\x00t\x00h\x00\x00\x00 ValueName => ThreadingModel |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x00000326 |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x0000031e |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x0000031e Registry => 0x80000000 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:33,492 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000031e SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:15:33,492 | 1660 | RegCloseKey |
Handle => 0x0000031e |
SUCCESS | 0x00000000 | |
| 09:15:33,512 | 1660 | LdrLoadDll |
Flags => 33286968 BaseAddress => 0x7e1e0000 FileName => C:\WINDOWS\system32\urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,512 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DllGetClassObject FunctionAddress => 0x7e1e603a ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,512 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DllCanUnloadNow FunctionAddress => 0x7e1e2eec ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,512 | 1660 | RegOpenKeyExA |
Handle => 0x0000032e Registry => 0x80000000 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:15:33,512 | 1660 | RegQueryValueExW |
Handle => 0x0000032e Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00u\x00r\x00l\x00m\x00o\x00n\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,512 | 1660 | LdrLoadDll |
Flags => 33289640 BaseAddress => 0x7e1e0000 FileName => C:\WINDOWS\system32\urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,512 | 1660 | RegCloseKey |
Handle => 0x0000032e |
SUCCESS | 0x00000000 | |
| 09:15:33,522 | 1660 | RegOpenKeyExA |
Handle => 0x0000032c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:33,522 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:15:33,522 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:15:33,522 | 1660 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:33,522 | 1660 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x00000334 SubKey => Ranges\ |
SUCCESS | 0x00000000 | |
| 09:15:33,522 | 1660 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 0 MaxSubKeyLength => 0 KeyHandle => 0x00000338 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,522 | 1660 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:33,522 | 1660 | NtCreateSection |
ObjectAttributes => C:\ntdll DesiredAccess => 0x000f0007 SectionHandle => 0x00000338 FileHandle => 0x00000000 |
SUCCESS | 0x40000000 | |
| 09:15:33,522 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbf5f8 SectionHandle => 0x00000338 ProcessHandle => 0xffffffff BaseAddress => 0x020e0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000002 SubKey => System\Setup |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegQueryValueExW |
Handle => 0x0000033c Data => 0 ValueName => SystemSetupInProgress |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x0000033c SubKey => 0 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x0000033c SubKey => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x0000033c SubKey => 2 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x0000033c SubKey => 3 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x0000033c SubKey => 4 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,532 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:15:33,532 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:15:33,532 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegEnumKeyExW |
Index => 0 Handle => 0x0000033c Name => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
FAILURE | 0x00000002 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
FAILURE | 0x00000002 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 33 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegEnumKeyExW |
Index => 1 Handle => 0x0000033c Name => 1 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
FAILURE | 0x00000002 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
FAILURE | 0x00000002 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 219 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegOpenKeyExA |
Handle => 0x00000348 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegSetValueExW |
Handle => 0x00000348 Buffer => 1 ValueName => ProxyBypass Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegSetValueExW |
Handle => 0x00000348 Buffer => 1 ValueName => IntranetName Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegSetValueExW |
Handle => 0x00000348 Buffer => 1 ValueName => UNCAsIntranet Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:33,542 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegEnumKeyExW |
Index => 2 Handle => 0x0000033c Name => 2 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
FAILURE | 0x00000002 | |
| 09:15:33,552 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
FAILURE | 0x00000002 | |
| 09:15:33,552 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 71 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,552 | 1660 | RegEnumKeyExW |
Index => 3 Handle => 0x0000033c Name => 3 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
FAILURE | 0x00000002 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
FAILURE | 0x00000002 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 1 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegEnumKeyExW |
Index => 4 Handle => 0x0000033c Name => 4 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
FAILURE | 0x00000002 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
FAILURE | 0x00000002 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 3 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegEnumKeyExW |
Index => 5 Handle => 0x0000033c Name => 4 Class => |
FAILURE | 0x00000103 | |
| 09:15:33,562 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:15:33,562 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegEnumKeyExW |
Index => 0 Handle => 0x0000033c Name => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
FAILURE | 0x00000002 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
FAILURE | 0x00000002 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 33 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegEnumKeyExW |
Index => 1 Handle => 0x0000033c Name => 1 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
FAILURE | 0x00000002 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
FAILURE | 0x00000002 | |
| 09:15:33,572 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:15:33,572 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 219 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000348 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegSetValueExW |
Handle => 0x00000348 Buffer => 1 ValueName => ProxyBypass Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegSetValueExW |
Handle => 0x00000348 Buffer => 1 ValueName => IntranetName Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegSetValueExW |
Handle => 0x00000348 Buffer => 1 ValueName => UNCAsIntranet Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegEnumKeyExW |
Index => 2 Handle => 0x0000033c Name => 2 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
FAILURE | 0x00000002 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
FAILURE | 0x00000002 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 71 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegEnumKeyExW |
Index => 3 Handle => 0x0000033c Name => 3 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
FAILURE | 0x00000002 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
FAILURE | 0x00000002 | |
| 09:15:33,582 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 1 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegEnumKeyExW |
Index => 4 Handle => 0x0000033c Name => 4 Class => |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
FAILURE | 0x00000002 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
FAILURE | 0x00000002 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => 3 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegEnumKeyExW |
Index => 5 Handle => 0x0000033c Name => 4 Class => |
FAILURE | 0x00000103 | |
| 09:15:33,592 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x0000033e Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\ |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\C\ |
FAILURE | 0x00000002 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\*\ |
FAILURE | 0x00000002 | |
| 09:15:33,592 | 1660 | RegCloseKey |
Handle => 0x0000033e |
SUCCESS | 0x00000000 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:15:33,592 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:15:33,602 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32 |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetLongPathNameW FunctionAddress => 0x7c8133e3 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:33,602 | 1660 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x00246b30 | |
| 09:15:33,602 | 1660 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
SUCCESS | 0x00246b30 | |
| 09:15:33,602 | 1660 | LdrLoadDll |
Flags => 33285480 BaseAddress => 0x7c9c0000 FileName => shell32.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | RegCreateKeyExW |
Handle => 0x0000033c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | RegQueryValueExW |
Handle => 0x0000033c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | RegCreateKeyExW |
Handle => 0x0000033c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | RegSetValueExW |
Handle => 0x0000033c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:33,602 | 1660 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x00246b30 | |
| 09:15:33,602 | 1660 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
SUCCESS | 0x00246b30 | |
| 09:15:33,602 | 1660 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:33,602 | 1660 | RegQueryValueExW |
Handle => 0x0000033c Data => 0 ValueName => 1806 |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | RegQueryValueExW |
Handle => 0x0000033c DataLength => 4 ValueName => Security_HKLM_only Type => 33289500 |
FAILURE | 0x00000002 | |
| 09:15:33,612 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:33,612 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:33,612 | 1660 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:33,612 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000033c SubKey => FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547 |
FAILURE | 0x00000002 | |
| 09:15:33,612 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:33,612 | 1660 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:33,612 | 1660 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | RegCloseKey |
Handle => 0x0000032c |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000032c ObjectAttributes => \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
SUCCESS | 0x00000000 | |
| 09:15:33,612 | 1660 | NtQueryValueKey |
Information => 1 KeyHandle => 0x0000032c ValueName => TransparentEnabled Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000027c SubKey => .exe |
FAILURE | 0x00000002 | 1 time |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x0000032e Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegQueryValueExW |
Handle => 0x0000032e Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000336 Registry => 0x80000000 SubKey => exefile |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000336 SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x0000033e Registry => 0x00000336 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegCloseKey |
Handle => 0x00000336 |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000336 Registry => 0x0000033e SubKey => shell\open |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000342 Registry => 0x00000336 SubKey => command |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegQueryValueExW |
Handle => 0x00000342 Data => "\x00%\x001\x00"\x00 \x00%\x00*\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegCloseKey |
Handle => 0x00000342 |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun |
FAILURE | 0x00000002 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000342 Registry => 0x00000336 SubKey => command |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegQueryValueExW |
Handle => 0x00000342 DataLength => 256 ValueName => command Type => 33290200 |
FAILURE | 0x00000002 | |
| 09:15:33,622 | 1660 | RegCloseKey |
Handle => 0x00000342 |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:15:33,622 | 1660 | RegOpenKeyExW |
Handle => 0x00000342 Registry => 0x00000336 SubKey => command |
SUCCESS | 0x00000000 | |
| 09:15:33,622 | 1660 | RegQueryValueExW |
Handle => 0x00000342 Data => "\x00%\x001\x00"\x00 \x00%\x00*\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | RegCloseKey |
Handle => 0x00000342 |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000336 SubKey => ddeexec |
FAILURE | 0x00000002 | |
| 09:15:33,632 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => Applications\Eula.exe |
FAILURE | 0x00000002 | |
| 09:15:33,632 | 1660 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\ShellNoRoam |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => userenv |
FAILURE | 3221225781 | 1 time |
| 09:15:33,632 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetProfileType FunctionAddress => 0x77f96930 ModuleHandle => 0x00400000 |
FAILURE | 3221225594 | |
| 09:15:33,632 | 1660 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x00000340 SubKey => MUICache |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32 |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserDefaultUILanguage FunctionAddress => 0x7c813100 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | RegQueryValueExW |
Handle => 0x00000344 Data => ValueName => LangID |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x00000344 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | RegQueryValueExW |
Handle => 0x00000348 DataLength => 520 ValueName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe Type => 33289760 |
FAILURE | 0x00000002 | |
| 09:15:33,632 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | LdrLoadDll |
Flags => 33288528 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,632 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeW FunctionAddress => 0x77c0138c ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:33,652 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
FAILURE | 3221225781 | |
| 09:15:33,652 | 1660 | NtCreateFile |
ShareAccess => 5 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:15:33,652 | 1660 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000348 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:15:33,652 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbeeec SectionHandle => 0x00000348 ProcessHandle => 0xffffffff BaseAddress => 0x020f0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoW FunctionAddress => 0x77c0166f ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
FAILURE | 3221225781 | |
| 09:15:33,672 | 1660 | NtCreateFile |
ShareAccess => 5 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000348 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbeedc SectionHandle => 0x00000348 ProcessHandle => 0xffffffff BaseAddress => 0x020f0000 |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueW FunctionAddress => 0x77c01805 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | RegQueryValueExW |
Handle => 0x00000348 DataLength => 68 ValueName => CutList Type => 7 |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | RegQueryValueExW |
Handle => 0x00000348 Data => ValueName => CutList |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,672 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x00000344 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegSetValueExW |
Handle => 0x00000348 Buffer => E\x00u\x00l\x00a\x00 \x00d\x00i\x00s\x00p\x00l\x00a\x00y\x00\x00\x00 ValueName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100180 CreateDisposition => 1 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000348 FileInformation => \x00s?\xb30\x9a\xcd\x01\x00\xaa9[\x8a\xa2\xcf\x01\x00s?\xb30\x9a\xcd\x01\xd0\xf3\x9c\xc3\xe6\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtSetInformationFile |
FileHandle => 0x00000348 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtReadFile |
Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x00\x00 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtSetInformationFile |
FileHandle => 0x00000348 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtReadFile |
Buffer => PE\x00\x00L\x01\x05\x00\xb0\xc5_P\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00"\x01\x0b\x01
\x00\x00\xaa\x00\x00\x00\x84\x00\x00\x00\x00\x00\x00\xa9\xad\x00\x00\x00\x10\x00\x00\x00\xc0\x00\x00\x00\x00@\x00\x00\x10\x00\x00\x00\x02\x00\x00 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtSetInformationFile |
FileHandle => 0x00000348 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtReadFile |
Buffer => \x05\x00\x01\x00 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtSetInformationFile |
FileHandle => 0x00000348 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | NtReadFile |
Buffer => \x02\x00@\x81 FileHandle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegQueryValueExW |
Handle => 0x00000348 DataLength => 4 ValueName => InheritConsoleHandles Type => 33289916 |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegQueryValueExW |
Handle => 0x00000348 DataLength => 4 ValueName => RestrictRun Type => 33290472 |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegQueryValueExW |
Handle => 0x00000348 DataLength => 4 ValueName => DisallowRun Type => 33290472 |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | 1 time |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegQueryValueExW |
Handle => 0x00000348 DataLength => 4 ValueName => NoRunasInstallPrompt Type => 33287748 |
FAILURE | 0x00000002 | |
| 09:15:33,682 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:33,682 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:15:33,752 | 1660 | CreateProcessInternalW |
ApplicationName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe ProcessId => 1728 CommandLine => "C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe" Adobe Reader XI;65758;1033 ThreadHandle => 0x00000358 ProcessHandle => 0x00000350 ThreadId => 1732 CreationFlags => 0x04000410 |
SUCCESS | 0x00000001 | |
| 09:15:33,752 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:33,752 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => browseui.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:33,752 | 1660 | RegCloseKey |
Handle => 0x00000336 |
SUCCESS | 0x00000000 | |
| 09:15:33,752 | 1660 | RegCloseKey |
Handle => 0x0000032e |
SUCCESS | 0x00000000 | |
| 09:15:33,752 | 1660 | RegCloseKey |
Handle => 0x0000033e |
SUCCESS | 0x00000000 | |
| 09:15:33,872 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:33,872 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:33,872 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:33,872 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:33,872 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\UserCache.bin DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:33,872 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,872 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xc09X[\x8a\xa2\xcf\x01\xc09X[\x8a\xa2\xcf\x01\xc09X[\x8a\xa2\xcf\x01\xc09X[\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00BL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:34,653 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:35,374 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0 DesiredAccess => 196639 KeyHandle => 0x00000358 Class => |
SUCCESS | 0x00000000 | |
| 09:15:35,384 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0\DiskCabs DesiredAccess => 196639 KeyHandle => 0x00000358 Class => |
SUCCESS | 0x00000000 | |
| 09:15:35,384 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,394 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,394 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,394 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,394 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,394 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,394 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,404 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,404 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,404 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,404 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,404 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,404 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,414 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,414 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,414 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,414 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,414 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,414 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,414 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,414 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,414 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,424 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,424 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,424 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,424 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,424 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,424 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,424 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,424 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,424 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,424 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,434 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,434 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,434 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,434 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,434 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,434 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,434 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,434 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,434 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,434 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,444 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,444 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,444 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,444 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,444 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00246b30 | |
| 09:15:35,444 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0 DesiredAccess => 196639 KeyHandle => 0x00000358 Class => |
SUCCESS | 0x00000000 | |
| 09:15:35,444 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0\DiskCabs DesiredAccess => 196639 KeyHandle => 0x00000358 Class => |
SUCCESS | 0x00000000 | |
| 09:15:35,444 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,454 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,454 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,454 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,454 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,454 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,454 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,454 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,454 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,454 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,454 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,464 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,464 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,464 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,464 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,464 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,464 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,464 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,464 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,464 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,475 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,475 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,475 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,475 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,475 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,475 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,475 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,475 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,475 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,485 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:35,485 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00246b30 | |
| 09:15:35,495 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,505 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,505 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,505 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,505 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00246b30 | |
| 09:15:35,505 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,515 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00246b30 | |
| 09:15:35,515 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,515 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00246b30 | |
| 09:15:35,515 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,515 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00246b30 | |
| 09:15:35,515 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,515 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00246b30 | |
| 09:15:35,515 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,525 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00246b30 | |
| 09:15:35,925 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,925 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,925 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,925 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,925 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,925 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,925 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,925 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,925 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000350 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:35,925 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000350 SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:15:35,925 | 1660 | RegOpenKeyExA |
Handle => 0x00000350 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:15:35,925 | 1660 | RegQueryValueExA |
Handle => 0x00000350 DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | RegQueryValueExA |
Handle => 0x00000350 Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | RegCloseKey |
Handle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | RegOpenKeyExA |
Handle => 0x00000350 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | RegQueryValueExA |
Handle => 0x00000350 Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | RegQueryValueExA |
Handle => 0x00000350 DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | RegQueryValueExA |
Handle => 0x00000350 Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,935 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | RegOpenKeyExA |
Handle => 0x00000358 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | RegQueryValueExA |
Handle => 0x00000358 DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | RegQueryValueExA |
Handle => 0x00000358 Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | RegCloseKey |
Handle => 0x00000358 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:15:35,945 | 1660 | RegCloseKey |
Handle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,945 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,945 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,945 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,945 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,945 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,945 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,955 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\H24JT5G9 DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,955 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,955 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,955 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:35,955 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,955 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,955 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b30 | |
| 09:15:35,955 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,955 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b30 | |
| 09:15:35,955 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x00120089 CreateDisposition => 2 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,965 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,965 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xf0\x97\x97\\x8a\xa2\xcf\x01\xf0\x97\x97\\x8a\xa2\xcf\x01\xf0\x97\x97\\x8a\xa2\xcf\x01\xf0\x97\x97\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00EL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x8a\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp |
SUCCESS | 0x00246b30 | |
| 09:15:35,965 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,965 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,965 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xf0\x97\x97\\x8a\xa2\xcf\x01\xf0\x97\x97\\x8a\xa2\xcf\x01\xf0\x97\x97\\x8a\xa2\xcf\x01\xf0\x97\x97\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00EL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x8a\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,965 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b30 | |
| 09:15:35,975 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:35,975 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b30 | |
| 09:15:35,975 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b30 | |
| 09:15:35,975 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp |
SUCCESS | 0x00246b30 | |
| 09:15:35,975 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:35,975 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,995 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:36,005 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b30 | |
| 09:15:36,015 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:36,015 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b30 | |
| 09:15:36,015 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b30 | |
| 09:15:36,015 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp DesiredAccess => 0x00100020 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,015 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,015 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:36,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:36,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:36,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:36,646 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:36,646 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,646 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,646 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,646 | 1660 | RegOpenKeyExW |
Handle => 0x00000350 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Internet Explorer |
SUCCESS | 0x00000000 | |
| 09:15:36,646 | 1660 | RegQueryValueExW |
Handle => 0x00000350 Data => 6\x00.\x000\x00.\x002\x009\x000\x000\x00.\x005\x005\x001\x002\x00\x00\x00 ValueName => Version |
SUCCESS | 0x00000000 | |
| 09:15:36,646 | 1660 | RegCloseKey |
Handle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,746 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:36,846 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,846 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,856 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:36,867 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:36,867 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,867 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,877 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:36,877 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:36,877 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:36,877 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,877 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,887 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:36,887 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:36,887 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:36,887 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,887 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,917 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:36,917 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:36,917 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:36,917 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,917 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,917 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:36,917 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:36,917 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:36,957 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:36,957 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:36,957 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,137 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,137 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,137 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,137 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,177 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,177 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,177 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,177 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,177 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,187 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,187 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,187 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,187 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,187 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,187 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,187 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xd0\x04R]\x8a\xa2\xcf\x01\xd0\x04R]\x8a\xa2\xcf\x01\xd0\x04R]\x8a\xa2\xcf\x01\xd0\x04R]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:37,187 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,187 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,187 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,187 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,207 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,207 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,207 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xd0\x04R]\x8a\xa2\xcf\x01\xd0\x04R]\x8a\xa2\xcf\x01\xd0\x04R]\x8a\xa2\xcf\x01\xd0\x04R]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf6)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xce\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:37,217 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,217 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,217 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,217 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,217 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,217 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,217 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,217 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,217 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,217 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,227 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,227 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,227 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,227 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,227 | 1468 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1468 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1468 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1468 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,227 | 1468 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000358 |
SUCCESS | 0x00000000 | |
| 09:15:37,227 | 1468 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000334 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,227 | 1380 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x00000350 | |
| 09:15:37,237 | 1380 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b30 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b30 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b30 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b30 | |
| 09:15:37,237 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xd0\x04R]\x8a\xa2\xcf\x01`\x9aV]\x8a\xa2\xcf\x01`\x9aV]\x8a\xa2\xcf\x01`\x9aV]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:37,237 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:37,247 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:37,247 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,247 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,247 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:37,247 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:37,247 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:37,247 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:37,247 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:37,247 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,247 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xd0\x04R]\x8a\xa2\xcf\x01\xc0\xa8Y]\x8a\xa2\xcf\x01`\x9aV]\x8a\xa2\xcf\x01`\x9aV]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,404 | 1660 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000358 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:42,404 | 1660 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000358 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com |
SUCCESS | 0x00000000 | |
| 09:15:42,404 | 1660 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000358 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com.v2 |
SUCCESS | 0x00000000 | |
| 09:15:42,414 | 1660 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000358 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 |
SUCCESS | 0x00000000 | 3 times |
| 09:15:43,045 | 1660 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000358 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:43,045 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,045 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,045 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,045 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,045 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,045 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,085 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,085 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,085 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,085 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,085 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,085 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,085 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,085 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,085 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,085 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,085 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14bcl-b4.pdf DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,085 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,085 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xa7a*2\xaf\x91\xcf\x01\xa7a*2\xaf\x91\xcf\x01\xa7a*2\xaf\x91\xcf\x01\xa7a*2\xaf\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00`\x00\x00\x00\x00\x00\x00EV\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xfcK\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00~\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,136 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,136 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,136 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,136 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,136 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,176 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,176 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,176 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,176 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,206 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,226 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,226 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,226 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:43,226 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,226 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,226 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,226 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,226 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:43,226 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:43,226 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,236 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,236 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,236 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:43,236 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,246 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,246 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,246 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:43,246 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,246 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,246 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,256 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,256 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:43,256 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14bcl-b4.pdf DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,256 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,256 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \xa7a*2\xaf\x91\xcf\x01\xa0\x1c\xd9`\x8a\xa2\xcf\x01\xa7a*2\xaf\x91\xcf\x01\xa7a*2\xaf\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00`\x00\x00\x00\x00\x00\x00EV\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xfcK\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00~\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,316 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,316 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,316 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:43,316 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:43,326 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,326 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,326 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,326 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,326 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246b68 | |
| 09:15:43,326 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246b68 | |
| 09:15:43,326 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246b68 | |
| 09:15:43,326 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,326 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,326 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000350 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,546 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,546 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,546 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,556 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,556 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,556 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,556 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246b68 | |
| 09:15:43,556 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:43,556 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000358 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,566 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246b68 | |
| 09:15:43,566 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00246b68 | |
| 09:15:44,127 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoRegisterClassObject FunctionAddress => 0x77517e90 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,127 | 1660 | RegOpenKeyExW |
Handle => 0x00000350 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:44,127 | 1660 | RegQueryValueExW |
Handle => 0x00000350 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:44,127 | 1660 | RegCloseKey |
Handle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:44,127 | 1660 | RegOpenKeyExW |
Handle => 0x00000350 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegQueryValueExW |
Handle => 0x00000350 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegCloseKey |
Handle => 0x00000350 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000352 Registry => 0x000002ae SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000352 SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x0000035a Registry => 0x000002ae SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegCloseKey |
Handle => 0x00000352 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000352 Registry => 0x0000035a SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000352 SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000352 SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000336 Registry => 0x00000352 SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegQueryValueExW |
Handle => 0x00000336 DataLength => 1000 ValueName => LocalServer32 Type => 33317992 |
FAILURE | 0x00000002 | |
| 09:15:44,137 | 1660 | RegCloseKey |
Handle => 0x00000336 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000352 SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000352 SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000336 Registry => 0x00000352 SubKey => InprocHandler32 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegQueryValueExW |
Handle => 0x00000336 Data => o\x00l\x00e\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegCloseKey |
Handle => 0x00000336 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegOpenKeyExW |
Handle => 0x00000336 Registry => 0x00000352 SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegQueryValueExW |
Handle => 0x00000336 Data => "\x00C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00\\x00A\x00c\x00r\x00o\x00R\x00d\x003\x002\x00.\x00e\x00x\x00e\x00"\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegCloseKey |
Handle => 0x00000336 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | RegCloseKey |
Handle => 0x00000352 |
SUCCESS | 0x00000000 | |
| 09:15:44,137 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\winlogon.exe |
FAILURE | 3221225781 | 1 time |
| 09:15:44,147 | 1660 | RegOpenKeyExW |
Handle => 0x0000034c Registry => 0x80000002 SubKey => Software\Microsoft\Ole |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | RegQueryValueExW |
Handle => 0x0000034c DataLength => 4 ValueName => MaximumAllowedAllocationSize Type => 33289812 |
FAILURE | 0x00000002 | |
| 09:15:44,147 | 1660 | RegCloseKey |
Handle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrLoadDll |
Flags => 33289776 BaseAddress => 0x02290000 FileName => xpsp2res.dll |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => AppID\AcroRd32.exe |
FAILURE | 0x00000002 | |
| 09:15:44,147 | 1660 | RegOpenKeyExW |
Handle => 0x00000348 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\OLE |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | RegQueryValueExW |
Handle => 0x00000348 DataLength => 256 ValueName => DefaultAccessPermission Type => 2349480 |
FAILURE | 0x00000002 | |
| 09:15:44,147 | 1660 | RegCloseKey |
Handle => 0x00000348 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | NtSetInformationFile |
FileHandle => 0x00000354 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:15:44,147 | 1660 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | NtReadFile |
Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xa6E\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000354 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000348 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000354 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000354 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | CreateThread |
ThreadId => 780 StartRoutine => 0x77e76c7d Parameter => 0x001f2d98 CreationFlags => 0 |
SUCCESS | 0x0000034c | |
| 09:15:44,147 | 1660 | LdrLoadDll |
Flags => 33290692 BaseAddress => 0x774e0000 FileName => OLE32 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetClassObject FunctionAddress => 0x775156c5 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetMarshalSizeMax FunctionAddress => 0x7752d6c0 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoMarshalInterface FunctionAddress => 0x7750ea71 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoUnmarshalInterface FunctionAddress => 0x7752d7f4 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => StringFromIID FunctionAddress => 0x7754659b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetPSClsid FunctionAddress => 0x775197f0 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemAlloc FunctionAddress => 0x774fd060 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,147 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoCreateInstance FunctionAddress => 0x7750057e ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoReleaseMarshalData FunctionAddress => 0x7750df23 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DcomChannelSetHResult FunctionAddress => 0x7752b1b7 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | CreateThread |
ThreadId => 1272 StartRoutine => 0x774fe43b Parameter => 0x001ecc88 CreationFlags => 0 |
SUCCESS | 0x00000364 | |
| 09:15:44,157 | 1660 | RegCloseKey |
Handle => 0x0000035a |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x00000358 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegQueryValueExW |
Handle => 0x00000358 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegCloseKey |
Handle => 0x00000358 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x00000358 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegQueryValueExW |
Handle => 0x00000358 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegCloseKey |
Handle => 0x00000358 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x0000035a Registry => 0x000002ae SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000035a SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x00000366 Registry => 0x000002ae SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegCloseKey |
Handle => 0x0000035a |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x0000035a Registry => 0x00000366 SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000035a SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000035a SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x0000036a Registry => 0x0000035a SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegQueryValueExW |
Handle => 0x0000036a DataLength => 1000 ValueName => LocalServer32 Type => 33317992 |
FAILURE | 0x00000002 | |
| 09:15:44,157 | 1660 | RegCloseKey |
Handle => 0x0000036a |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000035a SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000035a SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x0000036a Registry => 0x0000035a SubKey => InprocHandler32 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegQueryValueExW |
Handle => 0x0000036a Data => o\x00l\x00e\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegCloseKey |
Handle => 0x0000036a |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegOpenKeyExW |
Handle => 0x0000036a Registry => 0x0000035a SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegQueryValueExW |
Handle => 0x0000036a Data => "\x00C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00\\x00A\x00c\x00r\x00o\x00R\x00d\x003\x002\x00.\x00e\x00x\x00e\x00"\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegCloseKey |
Handle => 0x0000036a |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | RegCloseKey |
Handle => 0x0000035a |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoResumeClassObjects FunctionAddress => 0x77526d50 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246bd8 | |
| 09:15:44,157 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246bd8 | |
| 09:15:44,157 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246bd8 | |
| 09:15:44,157 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246bd8 | |
| 09:15:44,157 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000358 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000368 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000358 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,157 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246bd8 | |
| 09:15:44,157 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246bd8 | |
| 09:15:44,157 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246bd8 | |
| 09:15:44,157 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246bd8 | |
| 09:15:44,157 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000358 |
SUCCESS | 0x00000000 | |
| 09:15:44,157 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000368 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,167 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000358 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,197 | 1272 | LdrLoadDll |
Flags => 41287540 BaseAddress => 0x774e0000 FileName => OLE32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:44,197 | 1272 | NtDelayExecution |
Milliseconds => 60000 |
SUCCESS | 0x00000000 | |
| 09:15:44,538 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,538 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,538 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,538 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,538 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,538 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,538 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,538 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,538 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,548 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R660D.tmp |
SUCCESS | 4294967295 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,548 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,548 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,548 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,558 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,558 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,558 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,558 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,558 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,568 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,568 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,578 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,578 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14bcl-b4.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14bcl-b4.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,588 | 1660 | RegCreateKeyExW |
Handle => 0x0000036c Access => 131078 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000036c SubKey => cRecentFiles |
FAILURE | 0x00000002 | |
| 09:15:44,588 | 1660 | RegCreateKeyExW |
Handle => 0x00000370 Access => 131078 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1 |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | RegSetValueExW |
Handle => 0x00000370 Buffer => D\x00O\x00S\x00\x00\x00 ValueName => aFS Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | RegSetValueExW |
Handle => 0x00000370 Buffer => /\x00C\x00/\x00D\x00O\x00C\x00U\x00M\x00E\x00~\x001\x00/\x00T\x00D\x00W\x00/\x00L\x00O\x00C\x00A\x00L\x00S\x00~\x001\x00/\x00T\x00e\x00m\x00p\x00/\x00a\x00u\x00g\x001\x004\x00b\x00c\x00l\x00-\x00b\x004\x00.\x00p\x00d\x00f\x00\x00\x00 ValueName => tDIText Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | RegSetValueExW |
Handle => 0x00000370 Buffer => ValueName => sDI Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | RegSetValueExW |
Handle => 0x00000370 Buffer => ValueName => sDate Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | RegSetValueExW |
Handle => 0x00000370 Buffer => 22085 ValueName => uFileSize Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | RegSetValueExW |
Handle => 0x00000370 Buffer => 1 ValueName => uPageCount Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:44,588 | 1660 | RegCloseKey |
Handle => 0x00000370 |
SUCCESS | 0x00000000 | |
| 09:15:44,598 | 1660 | RegCloseKey |
Handle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,598 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,598 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,598 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,598 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,608 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,608 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,608 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,608 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,608 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,608 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,608 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,608 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,648 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,648 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,648 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,648 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,648 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,648 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,658 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,658 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,658 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,658 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,658 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,658 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,688 | 1660 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000370 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 |
SUCCESS | 0x00000000 | |
| 09:15:44,698 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,698 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,698 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,698 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,698 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,698 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,728 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,728 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,728 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,728 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,728 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,728 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,728 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,728 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:44,728 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:44,738 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:44,738 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:44,738 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,738 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,738 | 1660 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,738 | 1660 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,738 | 1660 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,748 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,748 | 1660 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,748 | 1660 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,748 | 1660 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,808 | 1660 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,808 | 1660 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,808 | 1660 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:44,808 | 1660 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000370 Class => |
SUCCESS | 0x00000000 | |
| 09:15:45,599 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,599 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,599 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,599 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,599 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,599 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,599 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,619 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,619 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,619 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,619 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,619 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,619 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,619 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,689 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,689 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,689 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,689 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,689 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,689 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,689 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,819 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,819 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,819 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,819 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,819 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,819 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,819 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,829 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,829 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,829 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,829 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,829 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,829 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,829 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,849 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,849 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,849 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,849 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,849 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,859 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,859 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,859 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,859 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,859 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,859 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,859 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,859 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,859 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,859 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,859 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,859 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,859 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,859 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,859 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,859 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,869 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,869 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,869 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,869 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,869 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,869 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,869 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,889 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,889 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,889 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,889 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,889 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,899 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,899 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,899 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,899 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,899 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,910 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,910 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,910 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,910 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,910 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,910 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,910 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,910 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,910 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,910 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,910 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,910 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,910 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,910 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,920 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,920 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,920 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,930 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,930 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,930 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,930 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,930 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,940 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,940 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,940 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,940 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,940 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,940 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,950 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,950 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,950 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,950 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,950 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,950 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,950 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,950 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,960 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,960 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,960 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,960 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,960 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,970 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,970 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,970 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,970 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,970 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,980 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,980 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,980 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,980 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,980 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,990 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,990 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,990 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,990 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,990 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,990 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,990 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,990 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,990 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,990 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:45,990 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:45,990 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:45,990 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:45,990 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:45,990 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,990 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,010 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,010 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,010 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,010 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,010 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,020 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,020 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,020 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,020 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,020 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,020 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,020 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,020 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,020 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,020 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,020 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,020 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,020 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,020 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,030 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,030 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,030 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,030 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,030 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,030 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,030 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,030 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,030 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,030 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,040 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,040 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,040 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,040 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,040 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,050 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,050 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,050 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,050 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,050 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,050 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,050 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,050 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,050 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,050 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,060 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,060 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,060 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,060 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01\x80K\x82Z\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,060 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,070 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,070 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,070 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => l\x9db\x8a\xa2\xcf\x01 l\x9db\x8a\xa2\xcf\x01 l\x9db\x8a\xa2\xcf\x01 l\x9db\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00GL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,100 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,100 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,100 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,100 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,110 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,110 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\x88\xa3b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,110 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,110 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\x88\xa3b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,110 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,110 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,110 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\x88\xa3b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,120 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,120 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\x88\xa3b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,120 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,120 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\x88\xa3b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,120 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,130 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,130 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10\x10\xa5b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,130 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,130 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@\x97\xa6b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,130 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,130 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,130 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@\x97\xa6b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,130 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,140 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,140 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,140 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,140 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,140 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,140 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@\x97\xa6b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,160 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,160 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,160 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\x1e\xa8b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,160 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,160 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,160 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\x1e\xa8b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,160 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,170 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,170 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,170 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,170 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,170 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,170 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0,\xabb\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,170 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,170 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,170 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,170 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,170 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,180 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,180 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x00\xb4\xacb\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,180 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,180 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,180 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,180 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,180 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,180 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,180 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x00\xb4\xacb\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,180 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,180 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,180 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,180 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,180 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,180 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,180 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010;\xaeb\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,200 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,200 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010;\xaeb\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,200 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,200 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010;\xaeb\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,200 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,210 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,210 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,210 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90I\xb1b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,210 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,210 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,210 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,210 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,210 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,210 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,220 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xd0\xb2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,220 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,220 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,220 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,220 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,220 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,220 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,220 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xd0\xb2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,220 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,220 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,220 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,230 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,230 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,230 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,230 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0W\xb4b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,230 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,230 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,230 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,230 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,230 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,230 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,230 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0W\xb4b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,240 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,240 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,240 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,240 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,240 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,240 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,240 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \xdf\xb5b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,240 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,240 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,240 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,240 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,240 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,240 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,240 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \xdf\xb5b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,250 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,250 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,250 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,250 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,250 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,250 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,250 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\xed\xb8b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,250 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,250 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00246ba0 | |
| 09:15:46,250 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,250 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,260 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,260 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,260 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\xed\xb8b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,310 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,310 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,320 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,320 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,320 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,320 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,330 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,330 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,330 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,330 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,330 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,330 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,330 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,330 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,330 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,330 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00'\xc5b\x8a\xa2\xcf\x01\x00'\xc5b\x8a\xa2\xcf\x01\x00'\xc5b\x8a\xa2\xcf\x01\x00'\xc5b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,330 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,330 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,330 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,340 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,340 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00'\xc5b\x8a\xa2\xcf\x01\x00'\xc5b\x8a\xa2\xcf\x01\x80\xf0\xd0[\x8a\xa2\xcf\x01\x00'\xc5b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,340 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,350 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,350 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,350 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,350 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => `5\xc8b\x8a\xa2\xcf\x01`5\xc8b\x8a\xa2\xcf\x01`5\xc8b\x8a\xa2\xcf\x01`5\xc8b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00JL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xda\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,350 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,360 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,360 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,360 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,360 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,370 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,370 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,370 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,370 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,370 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,380 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,380 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \xf0\xca\xccb\x8a\xa2\xcf\x01\xf0\xca\xccb\x8a\xa2\xcf\x01\xf0\xca\xccb\x8a\xa2\xcf\x01\xf0\xca\xccb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00LL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,380 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,380 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,380 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T |
SUCCESS | 0x00246ba0 | |
| 09:15:46,380 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,380 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,380 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,390 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => R\xceb\x8a\xa2\xcf\x01 R\xceb\x8a\xa2\xcf\x01 R\xceb\x8a\xa2\xcf\x01 R\xceb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00NL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,390 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,390 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,400 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,400 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,400 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN |
SUCCESS | 0x00246ba0 | |
| 09:15:46,410 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,410 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,410 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80`\xd1b\x8a\xa2\xcf\x01\x80`\xd1b\x8a\xa2\xcf\x01\x80`\xd1b\x8a\xa2\xcf\x01\x80`\xd1b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00PL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,410 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,410 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,410 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,420 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,420 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,420 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,420 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,430 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,430 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,430 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,430 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,430 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,440 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,440 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x10\xf6\xd5b\x8a\xa2\xcf\x01\x10\xf6\xd5b\x8a\xa2\xcf\x01\x10\xf6\xd5b\x8a\xa2\xcf\x01\x10\xf6\xd5b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00RL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J |
SUCCESS | 0x00246ba0 | |
| 09:15:46,440 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,450 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,450 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,450 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,450 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\6R8XG70J\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,460 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,460 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x10\xf6\xd5b\x8a\xa2\xcf\x01\x10\xf6\xd5b\x8a\xa2\xcf\x01\x10\xf6\xd5b\x8a\xa2\xcf\x01@}\xd7b\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00RL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,460 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\AL0T6T8T\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,470 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,470 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => R\xceb\x8a\xa2\xcf\x01 R\xceb\x8a\xa2\xcf\x01 R\xceb\x8a\xa2\xcf\x01 R\xceb\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00NL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,470 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,480 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\GHIJGLMN\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,480 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,480 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80`\xd1b\x8a\xa2\xcf\x01\x80`\xd1b\x8a\xa2\xcf\x01\x80`\xd1b\x8a\xa2\xcf\x01\xb0\xe7\xd2b\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00PL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,490 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\Q12FABW7\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,490 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,500 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \xf0\xca\xccb\x8a\xa2\xcf\x01\xf0\xca\xccb\x8a\xa2\xcf\x01\xf0\xca\xccb\x8a\xa2\xcf\x01\xf0\xca\xccb\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00LL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,500 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,500 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,500 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,500 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,500 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,500 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,500 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,510 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,510 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x00246ba0 | |
| 09:15:46,510 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,510 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,510 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => `\xa8\xe0b\x8a\xa2\xcf\x01`\xa8\xe0b\x8a\xa2\xcf\x01`\xa8\xe0b\x8a\xa2\xcf\x01`\xa8\xe0b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00TL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,510 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,520 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,520 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,520 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,520 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x00246ba0 | |
| 09:15:46,520 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies\index.dat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,520 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,520 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,520 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => `\xa8\xe0b\x8a\xa2\xcf\x01`\xa8\xe0b\x8a\xa2\xcf\x01\x80\xf0\xd0[\x8a\xa2\xcf\x01`\xa8\xe0b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00TL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,520 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,520 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,520 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,530 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,530 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,530 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,530 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,530 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,540 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,540 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,540 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,540 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \xf0=\xe5b\x8a\xa2\xcf\x01\xf0=\xe5b\x8a\xa2\xcf\x01\xf0=\xe5b\x8a\xa2\xcf\x01\xf0=\xe5b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00WL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,540 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\index.dat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,550 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,550 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \xf0=\xe5b\x8a\xa2\xcf\x01\xf0=\xe5b\x8a\xa2\xcf\x01\x80\xf0\xd0[\x8a\xa2\xcf\x01\xf0=\xe5b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00WL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,550 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,560 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,560 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,560 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:46,570 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,570 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,570 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,570 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,570 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80\xd3\xe9b\x8a\xa2\xcf\x01\x80\xd3\xe9b\x8a\xa2\xcf\x01\x80\xd3\xe9b\x8a\xa2\xcf\x01\x80\xd3\xe9b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00XL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,570 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,580 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,580 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x80\xd3\xe9b\x8a\xa2\xcf\x01\x80\xd3\xe9b\x8a\xa2\xcf\x01\x80\xd3\xe9b\x8a\xa2\xcf\x01\x80\xd3\xe9b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00XL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini |
SUCCESS | 0x00246ba0 | |
| 09:15:46,580 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,580 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,580 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00\xe9\x90|`G9\x000O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:46,590 | 1660 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000370 ObjectAttributes => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,590 | 1660 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000370 ObjectAttributes => Extensible Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,590 | 1660 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000370 ObjectAttributes => MSHist012014071820140719 |
SUCCESS | 0x00000000 | |
| 09:15:46,590 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,590 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00246ba0 | |
| 09:15:46,590 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,590 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00246ba0 | |
| 09:15:46,590 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00246ba0 | |
| 09:15:46,590 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat |
SUCCESS | 0x00246ba0 | |
| 09:15:46,590 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000036c |
SUCCESS | 0x00000000 | |
| 09:15:46,590 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000370 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,590 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000036c FileInformation => \x00'\xc5b\x8a\xa2\xcf\x01\x00'\xc5b\x8a\xa2\xcf\x01\xe0\xe1\xecb\x8a\xa2\xcf\x01\xe0\xe1\xecb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,641 | 1660 | LdrLoadDll |
Flags => 33291276 BaseAddress => 0x771b0000 FileName => WININET.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetOpenA FunctionAddress => 0x771c578e ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => FromCacheTimeout Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => SecureProtocols Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => CertificateRevocation Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DisableKeepAlive Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DisablePassport Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => CacheMode Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000374 DataLength => 4 ValueName => Security_HKLM_only Type => 884 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000378 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000374 DataLength => 4 ValueName => EnableHttp1_1 Type => 884 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000037c Data => 1 ValueName => EnableHttp1_1 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000037c DataLength => 4 ValueName => Security_HKLM_only Type => 892 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000378 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000037c DataLength => 4 ValueName => ProxyHttp1.1 Type => 892 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000374 DataLength => 4 ValueName => ProxyHttp1.1 Type => 884 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000378 DataLength => 4 ValueName => ProxyHttp1.1 Type => 888 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c Data => 1 ValueName => EnableNegotiate |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DisableBasicOverClearChannel Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExW |
Handle => 0x00000374 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000374 DataLength => 4 ValueName => Feature_ClientAuthCertFilter Type => 884 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => SyncMode5 Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000374 DataLength => 4 ValueName => FixupKey Type => 884 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000374 DataLength => 4 ValueName => SessionStartTimeDefaultDeltaSecs Type => 884 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000374 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000378 Registry => 0x80000002 SubKey => System\Setup |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000378 Data => 0 ValueName => SystemSetupInProgress |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000378 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000384 Data => Client UrlCache MMF Ver 5.2\x00 ValueName => Signature |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000384 DataLength => 54 ValueName => Cache Type => 2 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000384 DataLength => 22 ValueName => Cookies Type => 2 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000384 DataLength => 37 ValueName => History Type => 2 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x0000037c SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000384 DataLength => 4 ValueName => PerUserItem Type => 900 |
FAILURE | 0x00000002 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000388 Registry => 0x00000374 SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000388 Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x0000037c SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | LdrLoadDll |
Flags => 33288952 BaseAddress => 0x7c9c0000 FileName => shell32.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathA FunctionAddress => 0x7ca2ac11 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files DesiredAccess => 0x00100100 FileHandle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | NtSetInformationFile |
FileHandle => 0x00000388 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000384 Data => \x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegQueryValueExA |
Handle => 0x00000384 Data => 327323 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000388 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x0000038c Registry => 0x00000388 SubKey => Paths |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000390 Registry => 0x0000038c SubKey => Path1 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x0000038c SubKey => Path2 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x0000038c SubKey => Path3 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x0000038c SubKey => Path4 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x00000388 SubKey => Special Paths |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegSetValueExA |
Handle => 0x0000038c Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\x00 ValueName => Directory Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegSetValueExA |
Handle => 0x0000038c Buffer => 4 ValueName => Paths Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:46,641 | 1660 | RegSetValueExA |
Handle => 0x00000390 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache1\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegSetValueExA |
Handle => 0x00000394 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache2\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegSetValueExA |
Handle => 0x00000398 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache3\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegSetValueExA |
Handle => 0x0000039c Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache4\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegSetValueExA |
Handle => 0x00000390 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegSetValueExA |
Handle => 0x00000394 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegSetValueExA |
Handle => 0x00000398 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegSetValueExA |
Handle => 0x0000039c Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegOpenKeyExA |
Handle => 0x00000388 Registry => 0x0000037c SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExA |
Handle => 0x00000388 DataLength => 4 ValueName => PerUserItem Type => 904 |
FAILURE | 0x00000002 | |
| 09:15:46,651 | 1660 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x00000374 SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExA |
Handle => 0x000003a0 Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x0000037c SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExA |
Handle => 0x00000384 Data => Cookie:\x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExA |
Handle => 0x00000384 Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegOpenKeyExA |
Handle => 0x00000388 Registry => 0x0000037c SubKey => History |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExA |
Handle => 0x00000388 DataLength => 4 ValueName => PerUserItem Type => 904 |
FAILURE | 0x00000002 | |
| 09:15:46,651 | 1660 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x00000374 SubKey => History |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExA |
Handle => 0x000003a0 Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x0000037c SubKey => History |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCreateKeyExW |
Handle => 0x00000388 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExW |
Handle => 0x00000388 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCreateKeyExW |
Handle => 0x00000388 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegSetValueExW |
Handle => 0x00000388 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History DesiredAccess => 0x00100100 FileHandle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtSetInformationFile |
FileHandle => 0x00000388 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExA |
Handle => 0x00000384 Data => Visited:\x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegQueryValueExA |
Handle => 0x00000384 Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | RegCloseKey |
Handle => 0x00000374 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtOpenMutant |
Handle => 0x00000374 MutexName => _!MSFTHISTORY!_ |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtOpenMutant |
Handle => 0x0000037c MutexName => c:!documents and settings!tdw!local settings!temporary internet files!content.ie5! |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetDiskFreeSpaceExA FunctionAddress => 0x7c83038b ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtSetInformationFile |
FileHandle => 0x00000378 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtSetInformationFile |
FileHandle => 0x00000378 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Local Settings_Temporary Internet Files_Content.IE5_index.dat_245760 SectionHandle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbf924 SectionHandle => 0x00000380 ProcessHandle => 0xffffffff BaseAddress => 0x02100000 |
SUCCESS | 0x00000000 | |
| 09:15:46,651 | 1660 | NtOpenMutant |
Handle => 0x00000384 MutexName => c:!documents and settings!tdw!cookies! |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100001 FileHandle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100100 FileHandle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtSetInformationFile |
FileHandle => 0x00000388 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtSetInformationFile |
FileHandle => 0x00000388 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000388 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Cookies_index.dat_32768 SectionHandle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbf924 SectionHandle => 0x000003a0 ProcessHandle => 0xffffffff BaseAddress => 0x02140000 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenMutant |
Handle => 0x0000038c MutexName => c:!documents and settings!tdw!local settings!history!history.ie5! |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtSetInformationFile |
FileHandle => 0x00000390 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtSetInformationFile |
FileHandle => 0x00000390 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000390 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Local Settings_History_History.IE5_index.dat_32768 SectionHandle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbf924 SectionHandle => 0x00000394 ProcessHandle => 0xffffffff BaseAddress => 0x02150000 |
SUCCESS | 0x00000000 | |
| 09:15:46,661 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | NtSetInformationFile |
FileHandle => 0x00000398 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | NtSetInformationFile |
FileHandle => 0x00000398 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x00000398 SubKey => Extensible Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegEnumKeyExA |
Index => 0 Handle => 0x0000039c Name => MSHist012014071820140719 Class => |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x0000039c SubKey => MSHist012014071820140719 |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegQueryValueExA |
Handle => 0x00000398 Data => 0 ValueName => CacheRepair |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegQueryValueExA |
Handle => 0x00000398 Data => %USERPROFILE%\Local Settings\History\History.IE5\MSHist012014071820140719\\x00 ValueName => CachePath |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegQueryValueExA |
Handle => 0x00000398 Data => :2014071820140719: \x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegQueryValueExA |
Handle => 0x00000398 Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegQueryValueExA |
Handle => 0x00000398 Data => 11 ValueName => CacheOptions |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegEnumKeyExA |
Index => 1 Handle => 0x0000039c Name => MSHist012014071820140719 Class => |
FAILURE | 0x00000103 | |
| 09:15:46,671 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:46,671 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:15:46,671 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegQueryValueExW |
Handle => 0x0000039c DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,671 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,671 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,671 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,671 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,681 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000039c SubKey => FEATURE_AUTOPROXY_CACHE_ANAME_KB921400 |
FAILURE | 0x00000002 | |
| 09:15:46,681 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,681 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,681 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,681 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | 2 times |
| 09:15:46,681 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,681 | 1660 | RegQueryValueExW |
Handle => 0x0000039c DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,681 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,681 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,681 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,681 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,681 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,681 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000039c SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840387 |
FAILURE | 0x00000002 | |
| 09:15:46,681 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,681 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,681 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,681 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,691 | 1660 | RegQueryValueExW |
Handle => 0x0000039c DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000039c SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840386 |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,691 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,691 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,691 | 1660 | RegQueryValueExW |
Handle => 0x0000039c DataLength => 4 ValueName => Security_HKLM_only Type => 33290520 |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000039c SubKey => RETRY_HEADERONLYPOST_ONCONNECTIONRESET |
FAILURE | 0x00000002 | |
| 09:15:46,691 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,691 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,691 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,701 | 1660 | RegQueryValueExW |
Handle => 0x0000039c DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000039c SubKey => FEATURE_CHUNK_TIMEOUT_KB914453 |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,701 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,701 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,701 | 1660 | RegQueryValueExW |
Handle => 0x0000039c DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x0000039c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,701 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000039c SubKey => FEATURE_CERT_TRUST_VERIFIED_KB936882 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,711 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,711 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,711 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DisableReadRange Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => SocketSendBufferLength Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => SocketReceiveBufferLength Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => KeepAliveTimeout Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => MaxHttpRedirects Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => MaxConnectionsPerServer Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => MaxConnectionsPer1_0Server Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => ServerInfoTimeout Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => ReceiveTimeOut Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DisableNTLMPreAuth Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => ScavengeCacheLowerBound Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => CertCacheNoValidate Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,711 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => ScavengeCacheFileLifeTime Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => Security_HKLM_only Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,721 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,721 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,721 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_BUFFERBREAKING_818408 |
FAILURE | 0x00000002 | |
| 09:15:46,731 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,731 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,731 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,731 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,731 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954 |
FAILURE | 0x00000002 | |
| 09:15:46,731 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,731 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,731 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,731 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,731 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,731 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_ENSURE_FQDN_FOR_NEGOTIATE_KB899417 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_HTTP_DISABLE_NTLM_PREAUTH_IF_ABORTED_KB902409 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_WPAD_STORE_URL_AS_FQDN_KB903926 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_USE_CNAME_FOR_SPN_KB911149 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_KEEP_CACHE_INDEX_OPEN_KB899342 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_WAIT_TIME_THREAD_TERMINATE_KB886801 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExW |
Handle => 0x00000398 DataLength => 4 ValueName => Security_HKLM_only Type => 33290524 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000398 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000398 SubKey => FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => HttpDefaultExpiryTimeSecs Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => FtpDefaultExpiryTimeSecs Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => GopherDefaultExpiryTimeSecs Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DisableCachingOfSSLPages Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => PerUserCookies Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => LeashLegacyCookies Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DisableNT4RasCheck Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => DialupUseLanSettings Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => DialupUseLanSettings Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => SendExtraCRLF Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => BypassFtpTimeCheck Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableGopher Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => ReleaseSocketDuringAuth Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,741 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,741 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => WpadSearchAllDomains Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => EnableHttpTrace Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => EnableHttpTrace Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000039c DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 924 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => NonBlockingClient32 Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x00000398 DataLength => 4 ValueName => ShareCredsWithWinHttp Type => 920 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 66 ValueName => MimeExclusionListForCache Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c Data => multipart/mixed multipart/x-mixed-replace multipart/x-byteranges \x00 ValueName => MimeExclusionListForCache |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 0 ValueName => HeaderExclusionListForCache Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DnsCacheEnabled Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DnsCacheEntries Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => DnsCacheTimeout Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c Data => ValueName => WarnOnPost |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => WarnAlwaysOnPost Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c Data => 0 ValueName => WarnOnZoneCrossing |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => WarnOnBadCertSending Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => WarnOnBadCertRecving Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => WarnOnPostRedirect Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => AlwaysDrainOnRedirect Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => WarnOnHTTPSToHTTPRedirect Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | NtOpenMutant |
Handle => 0x00000398 MutexName => WininetStartupMutex |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => GlobalUserOffline Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | NtOpenMutant |
Handle => 0x000003a4 MutexName => WininetConnectionMutex |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | NtCreateMutant |
Handle => 0x000003a8 InitialOwner => 0 MutexName => |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | NtOpenMutant |
Handle => 0x000003ac MutexName => WininetProxyRegistryMutex |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rnaapp.exe |
FAILURE | 3221225781 | 1 time |
| 09:15:46,751 | 1660 | RegOpenKeyExA |
Handle => 0x000003b0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x000003b0 DataLength => 11 ValueName => UrlEncoding Type => 1 |
FAILURE | 0x000000ea | |
| 09:15:46,751 | 1660 | RegCloseKey |
Handle => 0x000003b0 |
SUCCESS | 0x00000000 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => TruncateFileName Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,751 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => BadProxyExpiresTime Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,771 | 1660 | LdrLoadDll |
Flags => 33290860 BaseAddress => 0x71ad0000 FileName => wsock32 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 1 FunctionName => FunctionAddress => 0x71ac1040 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 2 FunctionName => FunctionAddress => 0x71ab4480 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 3 FunctionName => FunctionAddress => 0x71ab3e2b ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 4 FunctionName => FunctionAddress => 0x71ab4a07 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 5 FunctionName => FunctionAddress => 0x71ac0b68 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 6 FunctionName => FunctionAddress => 0x71ab3d10 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 7 FunctionName => FunctionAddress => 0x71ad2ed6 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 8 FunctionName => FunctionAddress => 0x71ab2ead ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 9 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 10 FunctionName => FunctionAddress => 0x71ab2ee1 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 11 FunctionName => FunctionAddress => 0x71ab45c1 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 12 FunctionName => FunctionAddress => 0x71ab3f50 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 13 FunctionName => FunctionAddress => 0x71ab8cd3 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 15 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 16 FunctionName => FunctionAddress => 0x71ad2e70 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 17 FunctionName => FunctionAddress => 0x71ad3001 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 18 FunctionName => FunctionAddress => 0x71ab30a8 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 19 FunctionName => FunctionAddress => 0x71ab4c27 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 20 FunctionName => FunctionAddress => 0x71ab2f51 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 21 FunctionName => FunctionAddress => 0x71ad2e30 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 22 FunctionName => FunctionAddress => 0x71ac0bf6 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 23 FunctionName => FunctionAddress => 0x71ab4211 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 52 FunctionName => FunctionAddress => 0x71ab5355 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 57 FunctionName => FunctionAddress => 0x71ab5449 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 111 FunctionName => FunctionAddress => 0x71ab3cce ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 112 FunctionName => FunctionAddress => 0x71ab2a5e ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 115 FunctionName => FunctionAddress => 0x71ab6a55 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 116 FunctionName => FunctionAddress => 0x71ab3fed ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 151 FunctionName => FunctionAddress => 0x71ab3f7b ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | WSAStartup |
VersionRequested => 0x00000101 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrLoadDll |
Flags => 33290860 BaseAddress => 0x71ab0000 FileName => ws2_32 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceBeginW FunctionAddress => 0x71ab35ef ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceEnd FunctionAddress => 0x71ab350e ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceNextW FunctionAddress => 0x71ab3181 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSANSPIoctl FunctionAddress => 0x71ab5086 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => getaddrinfo FunctionAddress => 0x71ab2a6f ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => freeaddrinfo FunctionAddress => 0x71ab2b0b ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => getnameinfo FunctionAddress => 0x71abc689 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | CreateThread |
ThreadId => 512 StartRoutine => 0x771d922e Parameter => 0x001edd28 CreationFlags => 0 |
SUCCESS | 0x000003b8 | |
| 09:15:46,771 | 1660 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x000003bc FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbfcb0 SectionHandle => 0x000003bc ProcessHandle => 0xffffffff BaseAddress => 0x02160000 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 512 | socket |
type => 2 protocol => 17 af => 2 |
SUCCESS | 0x000003d4 | |
| 09:15:46,771 | 512 | bind |
ip => 127.0.0.1 socket => 0x000003d4 port => 0 |
SUCCESS | 0x00000000 | |
| 09:15:46,771 | 512 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x000003d4 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x0f\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,781 | 512 | connect |
socket => 0x000003d4 |
SUCCESS | 0x00000000 | |
| 09:15:46,791 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetSetStatusCallbackA FunctionAddress => 0x771d9064 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,791 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetConnectA FunctionAddress => 0x771c3452 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,791 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,791 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetQueryOptionW FunctionAddress => 0x771d5a5f ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,861 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpOpenRequestA FunctionAddress => 0x771c2af9 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,861 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA |
FAILURE | 0x00000002 | |
| 09:15:46,861 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA |
FAILURE | 0x00000002 | |
| 09:15:46,861 | 1660 | RegOpenKeyExW |
Handle => 0x000003c8 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,861 | 1660 | RegQueryValueExW |
Handle => 0x000003c8 DataLength => 4 ValueName => Security_HKLM_only Type => 33290628 |
FAILURE | 0x00000002 | |
| 09:15:46,861 | 1660 | RegCloseKey |
Handle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,861 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,861 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,861 | 1660 | RegOpenKeyExW |
Handle => 0x000003c8 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,861 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,861 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003c8 SubKey => FEATURE_INCLUDE_PORT_IN_SPN_KB908209 |
FAILURE | 0x00000002 | |
| 09:15:46,861 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,861 | 1660 | RegCloseKey |
Handle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,861 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,861 | 1660 | RegOpenKeyExW |
Handle => 0x000003c8 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,861 | 1660 | RegQueryValueExW |
Handle => 0x000003c8 DataLength => 4 ValueName => Security_HKLM_only Type => 33290624 |
FAILURE | 0x00000002 | |
| 09:15:46,861 | 1660 | RegCloseKey |
Handle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,861 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,871 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,871 | 1660 | RegOpenKeyExW |
Handle => 0x000003c8 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,871 | 1660 | RegOpenKeyExW |
Handle => 0x000003dc Registry => 0x000003c8 SubKey => FEATURE_MIME_HANDLING |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegQueryValueExW |
Handle => 0x000003dc DataLength => 4 ValueName => AcroRd32.exe Type => 33290596 |
FAILURE | 0x00000002 | |
| 09:15:46,871 | 1660 | RegQueryValueExW |
Handle => 0x000003dc DataLength => 4 ValueName => * Type => 33290596 |
FAILURE | 0x00000002 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x000003dc |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,871 | 1660 | RegOpenKeyExA |
Handle => 0x000003c8 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumKeyExA |
Index => 0 Handle => 0x000003c8 Name => EncodingType 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegOpenKeyExA |
Handle => 0x000003dc Registry => 0x000003c8 SubKey => EncodingType 0 |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegOpenKeyExA |
Handle => 0x000003e0 Registry => 0x000003dc SubKey => CertDllOpenStoreProv |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumKeyExA |
Index => 0 Handle => 0x000003e0 Name => #16 Class => |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegOpenKeyExA |
Handle => 0x000003e4 Registry => 0x000003e0 SubKey => #16 |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 36 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000003e4 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000003e4 Data => c\x00r\x00y\x00p\x00t\x00n\x00e\x00t\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000003e4 Data => L\x00d\x00a\x00p\x00P\x00r\x00o\x00v\x00O\x00p\x00e\x00n\x00S\x00t\x00o\x00r\x00e\x00\x00\x00 ValueName => FuncName |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumKeyExA |
Index => 1 Handle => 0x000003e0 Name => Ldap Class => |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegOpenKeyExA |
Handle => 0x000003e4 Registry => 0x000003e0 SubKey => Ldap |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 36 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000003e4 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000003e4 Data => c\x00r\x00y\x00p\x00t\x00n\x00e\x00t\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000003e4 Data => L\x00d\x00a\x00p\x00P\x00r\x00o\x00v\x00O\x00p\x00e\x00n\x00S\x00t\x00o\x00r\x00e\x00\x00\x00 ValueName => FuncName |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumKeyExA |
Index => 2 Handle => 0x000003e0 Name => Ldap Class => |
FAILURE | 0x00000103 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x000003dc |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumKeyExA |
Index => 1 Handle => 0x000003c8 Name => EncodingType 1 Class => |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegOpenKeyExA |
Handle => 0x000003dc Registry => 0x000003c8 SubKey => EncodingType 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x000003dc SubKey => CertDllOpenStoreProv |
FAILURE | 0x00000002 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x000003dc |
SUCCESS | 0x00000000 | |
| 09:15:46,871 | 1660 | RegEnumKeyExA |
Index => 2 Handle => 0x000003c8 Name => EncodingType 1 Class => |
FAILURE | 0x00000103 | |
| 09:15:46,871 | 1660 | RegCloseKey |
Handle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | RegOpenKeyExW |
Handle => 0x000003c8 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003c8 SubKey => Software\Microsoft\SystemCertificates\MY\PhysicalStores |
FAILURE | 0x00000002 | |
| 09:15:46,891 | 1660 | RegCloseKey |
Handle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | RegOpenKeyExW |
Handle => 0x000003c8 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | RegCreateKeyExW |
Handle => 0x000003dc Access => 983103 Registry => 0x000003c8 Class => SubKey => Software\Microsoft\SystemCertificates\MY |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | RegCloseKey |
Handle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | RegCloseKey |
Handle => 0x000003dc |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | LdrLoadDll |
Flags => 33289128 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeA FunctionAddress => 0x77c019ef ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => userenv.dll |
FAILURE | 3221225781 | |
| 09:15:46,891 | 1660 | NtCreateFile |
ShareAccess => 5 FileName => C:\WINDOWS\system32\userenv.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000003e0 FileHandle => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:46,891 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbf104 SectionHandle => 0x000003e0 ProcessHandle => 0xffffffff BaseAddress => 0x02960000 |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoA FunctionAddress => 0x77c01a40 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => userenv.dll |
FAILURE | 3221225781 | |
| 09:15:46,911 | 1660 | NtCreateFile |
ShareAccess => 5 FileName => C:\WINDOWS\system32\userenv.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000003c8 FileHandle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbf0f4 SectionHandle => 0x000003c8 ProcessHandle => 0xffffffff BaseAddress => 0x02960000 |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueA FunctionAddress => 0x77c018aa ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | LdrLoadDll |
Flags => 33289572 BaseAddress => 0x769c0000 FileName => userenv.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | LdrGetProcedureAddress |
Ordinal => 149 FunctionName => FunctionAddress => 0x769c1bc9 ModuleHandle => 0x769c0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | RegOpenKeyExW |
Handle => 0x000003e0 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:46,911 | 1660 | RegQueryValueExW |
Handle => 0x000003e0 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryValueExW |
Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryValueExW |
Handle => 0x000003e4 Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x000003e4 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x000003e4 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x000003e4 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x000003e4 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x000003e4 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x000003e4 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 8 Handle => 0x000003e4 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 9 Handle => 0x000003e4 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 10 Handle => 0x000003e4 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 11 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 12 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x000003e4 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x000003e4 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x000003e4 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x000003e4 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x000003e4 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 8 Handle => 0x000003e4 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 9 Handle => 0x000003e4 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 10 Handle => 0x000003e4 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 11 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 12 Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x000003e4 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x000003e8 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x000003e8 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryValueExW |
Handle => 0x000003e4 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryValueExW |
Handle => 0x000003e4 Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryValueExW |
Handle => 0x000003e4 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryValueExW |
Handle => 0x000003e4 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrLoadDll |
Flags => 33288824 BaseAddress => 0x77fe0000 FileName => secur32.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserNameExW FunctionAddress => 0x77fe1c70 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetComputerObjectNameW FunctionAddress => 0x77febed4 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TranslateNameW FunctionAddress => 0x77fec06b ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AcceptSecurityContext FunctionAddress => 0x77fe5351 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AcquireCredentialsHandleW FunctionAddress => 0x77fe3103 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DeleteSecurityContext FunctionAddress => 0x77fe2d0d ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FreeContextBuffer FunctionAddress => 0x77fe287e ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FreeCredentialsHandle FunctionAddress => 0x77fe2b91 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitializeSecurityContextW FunctionAddress => 0x77fe5bd3 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QuerySecurityContextToken FunctionAddress => 0x77fea43b ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QuerySecurityPackageInfoW FunctionAddress => 0x77fe386c ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrLoadDll |
Flags => 33288300 BaseAddress => 0x5b860000 FileName => netapi32.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsGetDcNameW FunctionAddress => 0x5b86d189 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsGetSiteNameW FunctionAddress => 0x5b87299f ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsRoleGetPrimaryDomainInformation FunctionAddress => 0x5b86cfdd ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsRoleFreeMemory FunctionAddress => 0x5b86cedd ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetApiBufferFree FunctionAddress => 0x5b867a00 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetUserGetGroups FunctionAddress => 0x5b894df0 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetUserGetInfo FunctionAddress => 0x5b86acf1 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtSetInformationFile |
FileHandle => 0x000003ec FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:15:46,921 | 1660 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00j(\x199\x0c\xb1\xd0\x11\x9b\xa8\x00\xc0O\xd9.\xf5\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtReadFile |
Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003f0 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryValueExW |
Handle => 0x000003f0 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003f0 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCreateKeyExW |
Handle => 0x000003f0 Access => 131103 Registry => 0x000003e4 Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegQueryValueExW |
Handle => 0x000003f0 Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003f0 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000003f0 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtQueryInformationFile |
FileHandle => 0x000003f0 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | NtReadFile |
Buffer => FileHandle => 0x000003f0 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003f0 Registry => 0x000003e4 SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000003f0 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000003f0 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x000003f0 DataLength => 4096 ValueName => TMP Type => 33288460 |
FAILURE | 0x00000103 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000003f0 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246cf0 | |
| 09:15:46,921 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00246cf0 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000003f0 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246cf0 | |
| 09:15:46,921 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00246cf0 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x000003f0 DataLength => 4096 ValueName => TMP Type => 33288460 |
FAILURE | 0x00000103 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003f0 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegOpenKeyExW |
Handle => 0x000003f0 Registry => 0x000003e4 SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000003f0 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000003f0 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x000003f0 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x000003f0 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x000003f0 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x000003f0 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x000003f0 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x000003f0 DataLength => 4096 ValueName => HOMEPATH Type => 33288460 |
FAILURE | 0x00000103 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x000003f0 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x000003f0 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x000003f0 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x000003f0 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x000003f0 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x000003f0 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x000003f0 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x000003f0 DataLength => 4096 ValueName => HOMEPATH Type => 33288460 |
FAILURE | 0x00000103 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003f0 |
SUCCESS | 0x00000000 | |
| 09:15:46,921 | 1660 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x02170000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x000003dc Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x000003e0 Registry => 0x000003dc SubKey => Software\Microsoft\SystemCertificates\MY |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegCloseKey |
Handle => 0x000003dc |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x000003dc Registry => 0x000003e0 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003dc SubKey => Certificates |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\Certificates\* |
SUCCESS | 0x00246cf0 | |
| 09:15:46,931 | 1660 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003e4 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003e4 FileInformation => |
FAILURE | 2147483654 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003dc SubKey => CRLs |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CRLs\* |
SUCCESS | 0x00246cf0 | |
| 09:15:46,931 | 1660 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003e4 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003e4 FileInformation => |
FAILURE | 2147483654 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003dc SubKey => CTLs |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CTLs\* |
SUCCESS | 0x00246cf0 | |
| 09:15:46,931 | 1660 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003e4 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003e4 FileInformation => |
FAILURE | 2147483654 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003dc SubKey => Keys |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrLoadDll |
Flags => 33290528 BaseAddress => 0x76c30000 FileName => wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WinVerifyTrust FunctionAddress => 0x76c32f2c ModuleHandle => 0x76c30000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WTHelperProvDataFromStateData FunctionAddress => 0x76c416e6 ModuleHandle => 0x76c30000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrLoadDll |
Flags => 33290412 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeA FunctionAddress => 0x77c019ef ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrLoadDll |
Flags => 33290456 BaseAddress => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoA FunctionAddress => 0x77c01a40 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrLoadDll |
Flags => 33288476 BaseAddress => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueA FunctionAddress => 0x77c018aa ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrLoadDll |
Flags => 33290828 BaseAddress => 0x767f0000 FileName => schannel |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitSecurityInterfaceA FunctionAddress => 0x77fe6a3c ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SslCrackCertificate FunctionAddress => 0x767f2e31 ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SslFreeCertificate FunctionAddress => 0x767f2e0c ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x77a80000 FileName => crypt32 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptInstallDefaultContext FunctionAddress => 0x77abcb30 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptUninstallDefaultContext FunctionAddress => 0x77abcc94 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CertFindChainInStore FunctionAddress => 0x77ac0d1e ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CertFreeCertificateChain FunctionAddress => 0x77a9b041 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000400 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegQueryValueExW |
Handle => 0x00000400 DataLength => 4 ValueName => Security_HKLM_only Type => 33290328 |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | RegCloseKey |
Handle => 0x00000400 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000400 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000400 SubKey => FEATURE_HTTP_USERNAME_PASSWORD_DISABLE |
FAILURE | 0x00000002 | |
| 09:15:46,931 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:46,931 | 1660 | RegCloseKey |
Handle => 0x00000400 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpAddRequestHeadersA FunctionAddress => 0x771c40ca ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpSendRequestA FunctionAddress => 0x771c60a1 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:46,931 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QueueUserWorkItem FunctionAddress => 0x7c830a52 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:46,951 | 1660 | LdrLoadDll |
Flags => 33291756 BaseAddress => 0x76ee0000 FileName => RASAPI32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasDialW FunctionAddress => 0x76ef68db ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasHangUpW FunctionAddress => 0x76ee8bcd ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEnumEntriesW FunctionAddress => 0x76ee3ce9 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetEntryDialParamsW FunctionAddress => 0x76ee7ad0 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetEntryDialParamsW FunctionAddress => 0x76ee917c ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEditPhonebookEntryW FunctionAddress => 0x76ee6839 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasCreatePhonebookEntryW FunctionAddress => 0x76ee6767 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetErrorStringW FunctionAddress => 0x76ee7d38 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetConnectStatusW FunctionAddress => 0x76ee70cb ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEnumConnectionsW FunctionAddress => 0x76ee2520 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetEntryPropertiesW FunctionAddress => 0x76ee9a5b ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetCredentialsW FunctionAddress => 0x76eeacb1 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetCredentialsW FunctionAddress => 0x76eeb078 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetAutodialAddressA FunctionAddress => 0x76eebbe0 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetAutodialAddressA FunctionAddress => 0x76eec044 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrLoadDll |
Flags => 33291604 BaseAddress => 0x76e80000 FileName => RTUTILS.DLL |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceRegisterExA FunctionAddress => 0x76e8212f ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDeregisterA FunctionAddress => 0x76e83ff9 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDeregisterExA FunctionAddress => 0x76e82d77 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TracePrintfA FunctionAddress => 0x76e81aad ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TracePrintfExA FunctionAddress => 0x76e819e2 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDumpExA FunctionAddress => 0x76e8253f ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegCreateKeyExA |
Handle => 0x00000438 Access => 983103 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Tracing |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000438 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegCloseKey |
Handle => 0x00000438 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegOpenKeyExA |
Handle => 0x00000440 Registry => 0x80000002 SubKey => Software\Microsoft\Tracing\RASAPI32 |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:15:46,961 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:15:46,971 | 1660 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x002471e0 | |
| 09:15:46,971 | 1660 | OpenServiceW |
ServiceControlManager => 0x002471e0 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x00247168 | |
| 09:15:46,971 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:46,971 | 1660 | OpenSCManagerA |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x00247208 | |
| 09:15:46,981 | 1660 | LdrLoadDll |
Flags => 33291760 BaseAddress => 0x722b0000 FileName => sensapi.dll |
SUCCESS | 0x00000000 | |
| 09:15:46,981 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsNetworkAlive FunctionAddress => 0x722b1260 ModuleHandle => 0x722b0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,991 | 1660 | NtOpenSection |
DesiredAccess => 0x00000004 ObjectAttributes => C:\SENS Information Cache SectionHandle => 0x00000454 |
SUCCESS | 0x00000000 | |
| 09:15:46,991 | 1660 | ZwMapViewOfSection |
SectionOffset => 0x01fbfdc8 SectionHandle => 0x00000454 ProcessHandle => 0xffffffff BaseAddress => 0x02ae0000 |
SUCCESS | 0x00000000 | |
| 09:15:46,991 | 1660 | NtWriteFile |
Buffer => \x05\x00\x0e\x03\x10\x00\x00\x00H\x00\x00\x00\x02\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x01\x00\x00\x00\x01\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:46,991 | 1660 | NtReadFile |
Buffer => \x05\x00\x0f\x03\x10\x00\x00\x008\x00\x00\x00\x02\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x00\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | RegOpenKeyExA |
Handle => 0x0000045c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | RegQueryValueExA |
Handle => 0x0000045c DataLength => 4 ValueName => ProxySettingsPerUser Type => 1116 |
FAILURE | 0x00000002 | |
| 09:15:47,011 | 1660 | RegCloseKey |
Handle => 0x0000045c |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | LdrLoadDll |
Flags => 33290204 BaseAddress => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | RegOpenKeyExW |
Handle => 0x0000045c Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | RegOpenKeyExA |
Handle => 0x00000460 Registry => 0x0000045c SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | RegQueryValueExA |
Handle => 0x00000460 Data => 1 ValueName => MigrateProxy |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | RegCloseKey |
Handle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:47,011 | 1660 | LdrLoadDll |
Flags => 33290128 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegCreateKeyExW |
Handle => 0x00000464 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Common AppData |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | LdrLoadDll |
Flags => 33288796 BaseAddress => 0x769c0000 FileName => USERENV.dll |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => ExpandEnvironmentStringsForUserW FunctionAddress => 0x769c7733 ModuleHandle => 0x769c0000 |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x00000468 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:47,021 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x00000468 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x00000468 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x00000468 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x00000468 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x00000468 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 8 Handle => 0x00000468 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 9 Handle => 0x00000468 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 10 Handle => 0x00000468 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 11 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 12 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x00000468 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x00000468 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:47,031 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x00000468 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:47,041 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x00000468 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:47,041 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x00000468 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegEnumValueW |
Index => 8 Handle => 0x00000468 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegEnumValueW |
Index => 9 Handle => 0x00000468 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegEnumValueW |
Index => 10 Handle => 0x00000468 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegEnumValueW |
Index => 11 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegEnumValueW |
Index => 12 Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000468 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000046c ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x0000046c ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,051 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:47,061 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:47,061 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:47,061 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,061 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:47,061 | 1660 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:47,061 | 1660 | RegQueryValueExW |
Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:15:47,061 | 1660 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,061 | 1660 | RegCreateKeyExW |
Handle => 0x0000046c Access => 131103 Registry => 0x00000468 Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | RegQueryValueExW |
Handle => 0x0000046c Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000046c FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | NtReadFile |
Buffer => FileHandle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x00000468 SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x0000046c DataLength => 4096 ValueName => TMP Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:15:47,071 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246d28 | |
| 09:15:47,071 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00246d28 | |
| 09:15:47,071 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:47,071 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246d28 | |
| 09:15:47,071 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00246d28 | |
| 09:15:47,071 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x0000046c DataLength => 4096 ValueName => TMP Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:15:47,071 | 1660 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x00000468 SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x0000046c Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x0000046c Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x0000046c Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x0000046c Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x0000046c Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x0000046c DataLength => 4096 ValueName => HOMEPATH Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x0000046c Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x0000046c Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x0000046c Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x0000046c Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x0000046c Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x0000046c DataLength => 4096 ValueName => HOMEPATH Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:15:47,081 | 1660 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x02af0000 |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegCreateKeyExW |
Handle => 0x00000464 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegSetValueExW |
Handle => 0x00000464 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Common AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:47,081 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk |
SUCCESS | 4294967295 | |
| 09:15:47,091 | 1660 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\Ras\*.pbk |
SUCCESS | 4294967295 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExW |
Handle => 0x00000468 Access => 33554432 Registry => 0x00000464 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x00000464 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x00000464 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x00000464 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x00000464 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x00000464 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x00000464 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 8 Handle => 0x00000464 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 9 Handle => 0x00000464 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 10 Handle => 0x00000464 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 11 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 12 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x00000464 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x00000464 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x00000464 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x00000464 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x00000464 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 8 Handle => 0x00000464 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 9 Handle => 0x00000464 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 10 Handle => 0x00000464 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 11 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 12 Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000464 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000046c ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x0000046c ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExW |
Handle => 0x0000046c Access => 131103 Registry => 0x00000464 Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExW |
Handle => 0x0000046c Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000046c FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | NtReadFile |
Buffer => FileHandle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x00000464 SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x0000046c DataLength => 4096 ValueName => TMP Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246d28 | |
| 09:15:47,091 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00246d28 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00246d28 | |
| 09:15:47,091 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00246d28 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x0000046c DataLength => 4096 ValueName => TMP Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x00000464 SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x0000046c Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x0000046c Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x0000046c Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x0000046c Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x0000046c Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x0000046c DataLength => 4096 ValueName => HOMEPATH Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 2 Handle => 0x0000046c Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 3 Handle => 0x0000046c Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 4 Handle => 0x0000046c Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 5 Handle => 0x0000046c Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 6 Handle => 0x0000046c Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegEnumValueW |
Index => 7 Handle => 0x0000046c DataLength => 4096 ValueName => HOMEPATH Type => 33288356 |
FAILURE | 0x00000103 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x02af0000 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExW |
Handle => 0x00000464 Access => 33554432 Registry => 0x00000468 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegSetValueExW |
Handle => 0x00000464 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\Network\Connections\Pbk\*.pbk |
SUCCESS | 4294967295 | |
| 09:15:47,091 | 1660 | RegCreateKeyExA |
Handle => 0x00000460 Access => 2 Registry => 0x0000045c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegSetValueExA |
Handle => 0x00000460 Buffer => 1 ValueName => MigrateProxy Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExA |
Handle => 0x00000460 Registry => 0x0000045c SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 Data => 0 ValueName => ProxyEnable |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 DataLength => 2084 ValueName => ProxyServer Type => 1120 |
FAILURE | 0x00000002 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 DataLength => 2084 ValueName => ProxyOverride Type => 1120 |
FAILURE | 0x00000002 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 DataLength => 2084 ValueName => AutoConfigURL Type => 1120 |
FAILURE | 0x00000002 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExA |
Handle => 0x00000460 Access => 1 Registry => 0x0000045c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 DataLength => 56 ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 Data => ValueName => SavedLegacySettings |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExA |
Handle => 0x00000460 Access => 1 Registry => 0x0000045c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 DataLength => 56 ValueName => DefaultConnectionSettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 Data => ValueName => DefaultConnectionSettings |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExA |
Handle => 0x00000460 Access => 131078 Registry => 0x0000045c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegSetValueExA |
Handle => 0x00000460 Buffer => 0 ValueName => ProxyEnable Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegDeleteValueA |
Handle => 0x00000460 ValueName => ProxyServer |
FAILURE | 0x00000002 | |
| 09:15:47,091 | 1660 | RegDeleteValueA |
Handle => 0x00000460 ValueName => ProxyOverride |
FAILURE | 0x00000002 | |
| 09:15:47,091 | 1660 | RegDeleteValueA |
Handle => 0x00000460 ValueName => AutoConfigURL |
FAILURE | 0x00000002 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExA |
Handle => 0x00000460 Access => 2 Registry => 0x80000005 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegSetValueExA |
Handle => 0x00000460 Buffer => 0 ValueName => ProxyEnable Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExA |
Handle => 0x00000460 Access => 1 Registry => 0x0000045c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 DataLength => 56 ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegQueryValueExA |
Handle => 0x00000460 Data => ValueName => SavedLegacySettings |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCreateKeyExA |
Handle => 0x00000464 Access => 2 Registry => 0x0000045c Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegSetValueExA |
Handle => 0x00000464 Buffer => ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | LdrLoadDll |
Flags => 33291144 BaseAddress => 0x7e1e0000 FileName => urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetCreateSecurityManager FunctionAddress => 0x7e1e30e7 ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetCreateZoneManager FunctionAddress => 0x7e1e9bd7 ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetIsFeatureEnabledForUrl FunctionAddress => 0x7e1ebb5e ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExA |
Handle => 0x00000464 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:47,091 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:15:47,091 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:15:47,091 | 1660 | RegOpenKeyExA |
Handle => 0x00000460 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegQueryValueExW |
Handle => 0x00000468 DataLength => 4 ValueName => Security_HKLM_only Type => 33289260 |
FAILURE | 0x00000002 | |
| 09:15:47,101 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:47,101 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:47,101 | 1660 | RegOpenKeyExW |
Handle => 0x00000468 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:47,101 | 1660 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000468 SubKey => FEATURE_VALIDATE_URLHOSTNAME |
FAILURE | 0x00000002 | |
| 09:15:47,101 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:47,101 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:47,101 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000460 SubKey => Domains\adobe.com |
FAILURE | 0x00000002 | |
| 09:15:47,101 | 1660 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adobe.com |
FAILURE | 0x00000002 | |
| 09:15:47,101 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => 1 ValueName => IntranetName |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegQueryValueExW |
Handle => 0x00000464 Data => 1 ValueName => ProxyBypass |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | LdrLoadDll |
Flags => 33289340 BaseAddress => 0x771b0000 FileName => WININET.dll |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsHostInProxyBypassList FunctionAddress => 0x771d3350 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegOpenKeyExA |
Handle => 0x00000468 Registry => 0x00000460 SubKey => ProtocolDefaults\ |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => 3 ValueName => https |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegOpenKeyExA |
Handle => 0x00000468 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegQueryValueExW |
Handle => 0x00000468 Data => 1 ValueName => 1A10 |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:47,101 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000388 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 22 times |
| 09:15:47,101 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,101 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000388 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,121 | 1660 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Cookies\tdw@adobe[2].txt DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,121 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000468 FileInformation => p\x00\x00\x00\x00\x00\x00\x00k\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,121 | 1660 | NtSetInformationFile |
FileHandle => 0x00000468 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:47,121 | 1660 | NtReadFile |
Buffer => s_vi
[CS]v1|29D65EC68507B15F-4000010EE001FA5C[CE]
adobe.com/
1024
839917312
30527303
1280773376
30380519
*
FileHandle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:47,121 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,121 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000388 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,121 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b103a8 | |
| 09:15:47,121 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x02b103a8 | |
| 09:15:47,131 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x02b103a8 | |
| 09:15:47,131 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:47,131 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,131 | 1660 | getaddrinfo |
ServiceName => NodeName => service-updates.adobe.com |
FAILURE | 0x00002af9 | |
| 09:15:47,131 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b103a8 | |
| 09:15:47,131 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x02b103a8 | |
| 09:15:47,131 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x02b103a8 | |
| 09:15:47,131 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b103a8 | |
| 09:15:47,141 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x02b103a8 | |
| 09:15:47,141 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x02b103a8 | |
| 09:15:47,141 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b103a8 | |
| 09:15:47,141 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x02b103a8 | |
| 09:15:47,141 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x02b103a8 | |
| 09:15:47,151 | 2004 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b103a8 | |
| 09:15:47,161 | 1660 | getaddrinfo |
ServiceName => NodeName => service-updates.adobe.com |
SUCCESS | 0x00000000 | |
| 09:15:47,161 | 1660 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000047c | |
| 09:15:47,161 | 1660 | ioctlsocket |
command => 2147772030 socket => 0x0000047c |
SUCCESS | 0x00000000 | |
| 09:15:47,161 | 1660 | bind |
ip => 0.0.0.0 socket => 0x0000047c port => 0 |
SUCCESS | 0x00000000 | |
| 09:15:47,161 | 1660 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000047c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:47,161 | 1660 | connect |
socket => 0x0000047c |
FAILURE | 4294967295 | |
| 09:15:47,161 | 512 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:15:47,161 | 512 | WSARecv |
socket => 0x000003d4 |
SUCCESS | 0x00000000 | |
| 09:15:47,161 | 1660 | send |
buffer => ! socket => 0x000003d4 |
SUCCESS | 0x00000001 | |
| 09:15:47,181 | 1660 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b103e0 | 2 times |
| 09:15:47,221 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,221 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,221 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,231 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,231 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,231 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,231 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0t\xbab\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,231 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,231 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,231 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,231 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,231 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,231 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,231 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\xadNc\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,231 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,231 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,231 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,241 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,241 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,241 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,241 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\xadNc\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,241 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,241 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,241 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,241 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,241 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,241 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,241 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x105Pc\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01\xb0\x01\xa2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,241 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,241 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,251 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,251 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,251 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,251 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,251 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => l\x9db\x8a\xa2\xcf\x01@\xbcQc\x8a\xa2\xcf\x01@\xbcQc\x8a\xa2\xcf\x01@\xbcQc\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00YL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,352 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,352 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,362 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,362 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,362 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,362 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,362 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,372 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,372 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,372 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,372 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,372 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,372 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,372 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,372 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,372 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\assets DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,372 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,632 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,632 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,632 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,632 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,632 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,632 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,632 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,632 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,632 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,632 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,632 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,632 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,632 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,632 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,642 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,642 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`\xcd\x8bc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,642 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,642 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`\xcd\x8bc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,642 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,652 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,652 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90T\x8dc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,652 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,652 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,652 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xdb\x8ec\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,652 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,652 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,652 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,652 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xdb\x8ec\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,672 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,672 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xdb\x8ec\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,672 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,672 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xdb\x8ec\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,672 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,682 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,682 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,682 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,682 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,682 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \xea\x91c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,682 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,682 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,682 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,682 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,682 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,682 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,682 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01Pq\x93c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,682 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,692 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,692 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01Pq\x93c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,692 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,692 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\xf8\x94c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,692 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,702 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,702 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,702 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,702 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\xf8\x94c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,702 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,702 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,702 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,702 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,702 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,702 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,712 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0\x7f\x96c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,722 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,722 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,722 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\x06\x98c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,722 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,722 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,722 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\x06\x98c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,722 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,732 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,732 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10\x8e\x99c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,732 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,732 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10\x8e\x99c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,732 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,742 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,742 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,742 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,742 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,742 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@\x15\x9bc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,752 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,752 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\x9c\x9cc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,752 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,752 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\x9c\x9cc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,762 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,762 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xa0#\x9ec\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,762 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,762 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0\xaa\x9fc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,762 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,762 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,772 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0\xaa\x9fc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,772 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,772 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,772 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x002\xa1c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,782 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,782 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,782 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x002\xa1c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,782 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,782 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,782 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x002\xa1c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,792 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,792 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010\xb9\xa2c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,792 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,792 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010\xb9\xa2c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,792 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,802 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,802 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,802 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,802 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`@\xa4c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,802 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,802 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,802 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,802 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,802 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,802 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,802 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90\xc7\xa5c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,802 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,812 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,812 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,812 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,812 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,812 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,812 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90\xc7\xa5c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,812 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,812 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,812 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,812 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,812 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,812 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,812 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0N\xa7c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,832 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,832 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0N\xa7c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,832 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,832 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0N\xa7c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,842 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,842 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 ]\xaac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,842 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,842 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P\xe4\xabc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,852 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,852 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,852 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P\xe4\xabc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,852 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,852 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,852 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80k\xadc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,862 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,862 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,862 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,862 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,862 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80k\xadc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,892 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,892 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,892 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,892 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,922 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,922 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,922 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80k\xadc\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,962 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,962 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,962 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,962 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,962 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,962 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,962 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0\x1d\xb8c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,982 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,982 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,982 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90:\xbec\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,982 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,982 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,982 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0H\xc1c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,982 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,993 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,993 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,993 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:47,993 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:47,993 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,993 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0H\xc1c\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x04ac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,993 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:47,993 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:47,993 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:47,993 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,053 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,053 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,053 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => l\x9db\x8a\xa2\xcf\x01 \xd0\xc2c\x8a\xa2\xcf\x01 \xd0\xc2c\x8a\xa2\xcf\x01 \xd0\xc2c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00ZL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,103 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,103 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,103 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010\x9f\xd3c\x8a\xa2\xcf\x010\x9f\xd3c\x8a\xa2\xcf\x010\x9f\xd3c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,103 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,103 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,103 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010\x9f\xd3c\x8a\xa2\xcf\x010\x9f\xd3c\x8a\xa2\xcf\x010\x9f\xd3c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,113 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,113 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => l\x9db\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00ZL\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,113 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,113 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,123 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,123 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,123 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,123 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,123 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,123 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,123 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90\xad\xd6c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,133 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,133 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90\xad\xd6c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,133 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,133 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90\xad\xd6c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,133 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,133 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,133 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc04\xd8c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,153 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,153 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc04\xd8c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,153 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,153 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc04\xd8c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,153 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,153 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,153 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 C\xdbc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,163 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,163 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,163 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,163 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,163 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,163 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,163 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 C\xdbc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,163 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,163 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,163 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,163 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,163 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,163 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,173 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 C\xdbc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,173 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,173 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,173 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80Q\xdec\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,173 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,183 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,183 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,183 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,183 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,183 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80Q\xdec\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,193 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,193 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0\xd8\xdfc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,193 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,193 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0_\xe1c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,193 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,203 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,203 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,203 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0_\xe1c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:48,203 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,203 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,203 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10\xe7\xe2c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,203 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b10418 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b10418 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b10418 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b10418 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b10418 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b10418 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b10418 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b10418 | |
| 09:15:48,203 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,203 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,203 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R660E.tmp |
SUCCESS | 4294967295 | |
| 09:15:48,213 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b10418 | |
| 09:15:48,213 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b10418 | |
| 09:15:48,213 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b10418 | |
| 09:15:48,213 | 1660 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b10418 | |
| 09:15:48,213 | 1660 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\A9R660E.tmp DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,213 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,213 | 1660 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => @n\xe4c\x8a\xa2\xcf\x01@n\xe4c\x8a\xa2\xcf\x01@n\xe4c\x8a\xa2\xcf\x01@n\xe4c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00ZL\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x90\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,213 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:48,213 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:48,213 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:15:48,213 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:48,213 | 1660 | getaddrinfo |
ServiceName => NodeName => acroipm2.adobe.com |
FAILURE | 0x00002af9 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,223 | 2004 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,223 | 2004 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10\xe7\xe2c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,223 | 2004 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,223 | 2004 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10\xe7\xe2c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10450 | |
| 09:15:48,223 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,233 | 2004 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,233 | 2004 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\xf5\xe5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,233 | 2004 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,233 | 2004 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\xf5\xe5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,233 | 2004 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,233 | 2004 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xa0|\xe7c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10450 | |
| 09:15:48,233 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10450 | |
| 09:15:48,243 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10450 | |
| 09:15:48,243 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10450 | |
| 09:15:48,243 | 2004 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,243 | 2004 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,243 | 2004 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xa0|\xe7c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,243 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10450 | |
| 09:15:48,243 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10450 | |
| 09:15:48,243 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10450 | |
| 09:15:48,243 | 2004 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10450 | |
| 09:15:48,243 | 2004 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,243 | 2004 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,243 | 2004 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0\x03\xe9c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,253 | 1660 | getaddrinfo |
ServiceName => NodeName => acroipm2.adobe.com |
SUCCESS | 0x00000000 | |
| 09:15:48,253 | 1660 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:15:48,253 | 1660 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:48,253 | 1660 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:15:48,253 | 1660 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:48,253 | 1660 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:15:48,253 | 512 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:15:48,253 | 512 | WSARecv |
socket => 0x000003d4 |
SUCCESS | 0x00000000 | |
| 09:15:48,253 | 1660 | send |
buffer => ! socket => 0x000003d4 |
SUCCESS | 0x00000001 | |
| 09:15:48,263 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,263 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,263 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,263 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,263 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,263 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,263 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0\x03\xe9c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,263 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,263 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,263 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,263 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,263 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,263 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,263 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0\x03\xe9c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,273 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,273 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,273 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,273 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,273 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,273 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,273 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010\x12\xecc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,273 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,273 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,273 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,273 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,273 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,273 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,273 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010\x12\xecc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,283 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,283 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`\x99\xedc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,283 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,283 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`\x99\xedc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,283 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,283 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,283 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90 \xefc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,293 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,293 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,293 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,293 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,293 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,293 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,293 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90 \xefc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,303 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,303 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,303 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xa7\xf0c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,303 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,303 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,303 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xa7\xf0c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,303 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,313 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,313 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0.\xf2c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,313 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,313 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0.\xf2c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,313 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,323 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,323 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,323 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,323 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,323 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \xb6\xf3c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,323 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,323 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,323 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,323 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,323 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,323 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,323 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \xb6\xf3c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,323 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,323 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,333 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,333 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P=\xf5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,333 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,333 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P=\xf5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,333 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,333 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,333 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\xc4\xf6c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,353 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,353 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,353 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,353 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,353 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,353 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,353 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\xc4\xf6c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,353 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,353 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,353 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,353 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,353 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,353 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,353 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\xc4\xf6c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,363 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,363 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,363 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,363 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,363 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,363 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,363 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10Z\xfbc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,433 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,433 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10Z\xfbc\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,433 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,433 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`\x0c\x06d\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,433 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,443 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,443 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,443 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,443 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,443 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`\x0c\x06d\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01`&\xd5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,443 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,443 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,443 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,443 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,443 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,443 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,443 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\x90\x93\x07d\x8a\xa2\xcf\x01\x90\x93\x07d\x8a\xa2\xcf\x01\x90\x93\x07d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,453 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,453 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,453 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,463 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,463 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\x1a d\x8a\xa2\xcf\x01\xc0\x1a d\x8a\xa2\xcf\x01\xc0\x1a d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,463 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,463 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0\xa1 d\x8a\xa2\xcf\x01\xc0\x1a d\x8a\xa2\xcf\x01\xc0\x1a d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,463 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,463 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,463 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xf0\xa1 d\x8a\xa2\xcf\x01\xf0\xa1 d\x8a\xa2\xcf\x01\xf0\xa1 d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,473 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,473 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,473 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,473 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,473 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,473 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,473 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,473 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,473 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,473 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,804 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,804 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,804 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,804 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,804 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,804 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,804 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 )\x0cd\x8a\xa2\xcf\x01 )\x0cd\x8a\xa2\xcf\x01 )\x0cd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,814 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,814 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,814 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,814 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,814 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,824 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,824 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\x1d@d\x8a\xa2\xcf\x01 )\x0cd\x8a\xa2\xcf\x01 )\x0cd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,824 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,824 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,824 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,824 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,834 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,834 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,834 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0\xa4Ad\x8a\xa2\xcf\x01 )\x0cd\x8a\xa2\xcf\x01 )\x0cd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,834 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,834 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,834 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,834 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,844 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,844 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,844 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xe0+Cd\x8a\xa2\xcf\x01\xe0+Cd\x8a\xa2\xcf\x01\xe0+Cd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,854 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,864 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,864 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,864 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,864 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,864 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,864 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,864 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,864 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,864 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,874 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,874 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,874 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,874 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,874 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,874 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,874 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@:Fd\x8a\xa2\xcf\x01@:Fd\x8a\xa2\xcf\x01@:Fd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,874 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,874 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,874 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,874 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,884 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,884 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,884 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xa0HId\x8a\xa2\xcf\x01@:Fd\x8a\xa2\xcf\x01@:Fd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,884 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,884 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,884 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,884 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,884 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,884 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,884 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xd0\xcfJd\x8a\xa2\xcf\x01\xd0\xcfJd\x8a\xa2\xcf\x01\xd0\xcfJd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,904 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,904 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,904 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,904 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,904 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,904 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,904 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,904 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,904 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,904 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,244 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,244 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,254 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,254 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,254 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,254 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,254 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010\xdeMd\x8a\xa2\xcf\x010\xdeMd\x8a\xa2\xcf\x010\xdeMd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,254 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,254 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,254 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,254 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,254 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,254 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,254 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0Y\x83d\x8a\xa2\xcf\x010\xdeMd\x8a\xa2\xcf\x010\xdeMd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,254 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,264 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,264 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,264 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,264 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,264 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,264 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0Y\x83d\x8a\xa2\xcf\x010\xdeMd\x8a\xa2\xcf\x010\xdeMd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,264 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,264 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,264 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,264 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,264 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,264 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,264 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xf0\xe0\x84d\x8a\xa2\xcf\x01\xf0\xe0\x84d\x8a\xa2\xcf\x01\xf0\xe0\x84d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,274 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,274 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,274 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,274 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 h\x86d\x8a\xa2\xcf\x01 h\x86d\x8a\xa2\xcf\x01 h\x86d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,284 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,284 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01 h\x86d\x8a\xa2\xcf\x01 h\x86d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,284 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,284 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,284 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,294 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,294 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,294 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,294 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,294 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,294 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,615 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,615 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,615 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,615 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,615 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,615 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,615 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,625 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,625 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,625 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,625 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,625 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,625 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,635 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0\xe3\xbbd\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,635 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,635 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,635 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,635 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,645 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,645 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,645 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0j\xbdd\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01P\xef\x87d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,645 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,645 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,645 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,645 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,645 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,645 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,645 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\x10\xf2\xbed\x8a\xa2\xcf\x01\x10\xf2\xbed\x8a\xa2\xcf\x01\x10\xf2\xbed\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,665 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,665 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,665 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,665 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,665 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,665 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,665 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,665 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,675 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,675 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,675 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,675 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,675 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,675 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,675 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,675 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,675 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\x00\xc2d\x8a\xa2\xcf\x01p\x00\xc2d\x8a\xa2\xcf\x01p\x00\xc2d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,685 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,685 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,685 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,685 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,685 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,685 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,685 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0\x0e\xc5d\x8a\xa2\xcf\x01p\x00\xc2d\x8a\xa2\xcf\x01p\x00\xc2d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,685 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,695 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,695 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,695 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,695 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,695 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,695 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\x00\x96\xc6d\x8a\xa2\xcf\x01\x00\x96\xc6d\x8a\xa2\xcf\x01\x00\x96\xc6d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,765 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,765 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,765 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,775 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,775 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,775 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,775 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,775 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,775 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,775 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,096 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,096 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,096 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,096 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,096 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,096 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,096 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01PH\xd1d\x8a\xa2\xcf\x01PH\xd1d\x8a\xa2\xcf\x01PH\xd1d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,106 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,106 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,106 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,106 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,106 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,106 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,116 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0<\x05e\x8a\xa2\xcf\x01PH\xd1d\x8a\xa2\xcf\x01PH\xd1d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,116 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,116 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,116 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,116 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,116 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,116 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,116 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\xc3\x06e\x8a\xa2\xcf\x01PH\xd1d\x8a\xa2\xcf\x01PH\xd1d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,126 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,126 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,126 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,126 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,126 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,126 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,126 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\x10K\x08e\x8a\xa2\xcf\x01\x10K\x08e\x8a\xa2\xcf\x01\x10K\x08e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,136 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,146 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,146 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,146 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,146 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,146 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,146 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,146 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,146 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,146 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,146 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,156 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,156 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,156 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,156 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,156 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,156 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@\xd2 e\x8a\xa2\xcf\x01@\xd2 e\x8a\xa2\xcf\x01@\xd2 e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,156 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,166 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,166 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,166 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,166 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,166 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,166 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xa0\xe0\x0ce\x8a\xa2\xcf\x01@\xd2 e\x8a\xa2\xcf\x01@\xd2 e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,166 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,166 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,176 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,176 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,176 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,176 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\x00\xef\x0fe\x8a\xa2\xcf\x01\x00\xef\x0fe\x8a\xa2\xcf\x01\x00\xef\x0fe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,186 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,186 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,186 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,186 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,186 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,196 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,196 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,196 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,196 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,196 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,516 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,516 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,516 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,516 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,516 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,516 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,516 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010v\x11e\x8a\xa2\xcf\x010v\x11e\x8a\xa2\xcf\x010v\x11e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,516 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,516 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,516 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,516 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,516 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,526 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,526 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`\xe3Ce\x8a\xa2\xcf\x010v\x11e\x8a\xa2\xcf\x010v\x11e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,526 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,526 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,526 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,526 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,526 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,526 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,526 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90jEe\x8a\xa2\xcf\x010v\x11e\x8a\xa2\xcf\x010v\x11e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,526 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,526 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,526 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,526 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,526 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,526 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,526 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\x90jEe\x8a\xa2\xcf\x01\x90jEe\x8a\xa2\xcf\x01\x90jEe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,536 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,536 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,536 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xf1Fe\x8a\xa2\xcf\x01\xc0\xf1Fe\x8a\xa2\xcf\x01\xc0\xf1Fe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,536 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,546 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,546 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xf1Fe\x8a\xa2\xcf\x01\xc0\xf1Fe\x8a\xa2\xcf\x01\xc0\xf1Fe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,546 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,546 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,546 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,556 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,556 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,556 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,556 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,556 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,867 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,867 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,867 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,867 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,867 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,867 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,867 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,877 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,877 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,877 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,877 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,877 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,887 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,887 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \xe6ze\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,887 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,887 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,887 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,887 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,897 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,897 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,897 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01Pm|e\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01\xf0xHe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,897 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,897 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,897 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,897 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,897 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,897 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,897 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\x80\xf4}e\x8a\xa2\xcf\x01\x80\xf4}e\x8a\xa2\xcf\x01\x80\xf4}e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,947 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,957 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,957 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,957 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,957 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,957 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,967 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,967 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,967 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,967 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,967 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,967 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,967 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,967 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,967 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,977 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,977 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\x98\x85e\x8a\xa2\xcf\x01p\x98\x85e\x8a\xa2\xcf\x01p\x98\x85e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,977 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,977 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,977 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,977 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,977 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,977 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,977 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x00.\x8ae\x8a\xa2\xcf\x01p\x98\x85e\x8a\xa2\xcf\x01p\x98\x85e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,987 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,987 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,987 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,987 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,987 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,987 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,987 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x010\xb5\x8be\x8a\xa2\xcf\x010\xb5\x8be\x8a\xa2\xcf\x010\xb5\x8be\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,097 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,097 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,097 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,097 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,097 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,097 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,107 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,107 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,107 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,107 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,427 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,427 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,427 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,427 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,427 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,427 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,427 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@\x84\x9ce\x8a\xa2\xcf\x01@\x84\x9ce\x8a\xa2\xcf\x01@\x84\x9ce\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,457 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,457 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,457 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,457 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,457 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,457 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,457 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x00\x87\xd3e\x8a\xa2\xcf\x01@\x84\x9ce\x8a\xa2\xcf\x01@\x84\x9ce\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,508 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,508 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,508 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,508 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,508 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,508 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,508 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x00\x87\xd3e\x8a\xa2\xcf\x01@\x84\x9ce\x8a\xa2\xcf\x01@\x84\x9ce\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,508 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,508 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,508 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,518 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,538 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,538 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,538 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01 \xb2\xdce\x8a\xa2\xcf\x01 \xb2\xdce\x8a\xa2\xcf\x01 \xb2\xdce\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,608 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,608 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,608 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,618 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,618 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xd0r\xeae\x8a\xa2\xcf\x01\xd0r\xeae\x8a\xa2\xcf\x01\xd0r\xeae\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,618 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,618 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x00\xfa\xebe\x8a\xa2\xcf\x01\xd0r\xeae\x8a\xa2\xcf\x01\xd0r\xeae\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,618 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,628 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,628 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,628 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,628 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,638 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,958 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,958 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,958 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,958 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,958 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,958 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,958 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,968 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,968 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,968 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,968 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,968 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,978 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,978 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90u!f\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,978 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,978 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,978 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,978 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,978 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,988 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,988 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xfc"f\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x010\x81\xede\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,988 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,988 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,988 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,988 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,988 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,988 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,988 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xf0\x83$f\x8a\xa2\xcf\x01\xf0\x83$f\x8a\xa2\xcf\x01\xf0\x83$f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x11\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,038 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,038 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,038 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,038 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,048 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,048 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,048 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,048 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,058 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0',f\x8a\xa2\xcf\x01\xe0',f\x8a\xa2\xcf\x01\xe0',f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,058 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,058 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,058 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,058 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,058 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,058 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,058 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@6/f\x8a\xa2\xcf\x01\xe0',f\x8a\xa2\xcf\x01\xe0',f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,068 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,068 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,068 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,068 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,068 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,068 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,068 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01p\xbd0f\x8a\xa2\xcf\x01p\xbd0f\x8a\xa2\xcf\x01p\xbd0f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,078 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,078 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,078 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,078 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,078 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,078 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,078 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,078 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,078 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,078 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,399 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,399 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,399 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,399 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,399 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,399 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,399 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xa0D2f\x8a\xa2\xcf\x01\xa0D2f\x8a\xa2\xcf\x01\xa0D2f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,399 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,409 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,409 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,409 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,409 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,409 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,419 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xa0*cf\x8a\xa2\xcf\x01\xa0D2f\x8a\xa2\xcf\x01\xa0D2f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,419 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,419 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,419 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,419 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,419 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,419 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,419 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x009ff\x8a\xa2\xcf\x01\xa0D2f\x8a\xa2\xcf\x01\xa0D2f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,429 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,429 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,429 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,429 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,429 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,429 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,429 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x010\xc0gf\x8a\xa2\xcf\x010\xc0gf\x8a\xa2\xcf\x010\xc0gf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,439 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,449 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,449 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,449 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,449 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,449 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,449 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,449 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,449 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,449 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,459 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,459 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,459 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,459 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,459 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,459 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,459 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01`Gif\x8a\xa2\xcf\x01`Gif\x8a\xa2\xcf\x01`Gif\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,459 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,469 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,469 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,469 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,469 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,469 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,479 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0Ulf\x8a\xa2\xcf\x01`Gif\x8a\xa2\xcf\x01`Gif\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,479 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,479 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,479 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,479 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,479 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,479 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,479 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01 dof\x8a\xa2\xcf\x01 dof\x8a\xa2\xcf\x01 dof\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,489 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,489 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,499 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,499 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,499 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,499 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,499 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,499 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,499 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,499 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,819 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,829 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,829 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,829 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P\xebpf\x8a\xa2\xcf\x01P\xebpf\x8a\xa2\xcf\x01P\xebpf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,829 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,829 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,829 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,839 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0\xdf\xa4f\x8a\xa2\xcf\x01P\xebpf\x8a\xa2\xcf\x01P\xebpf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,839 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,839 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,839 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,839 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,839 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,839 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,839 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0f\xa6f\x8a\xa2\xcf\x01P\xebpf\x8a\xa2\xcf\x01P\xebpf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,839 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,839 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,839 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,839 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,839 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,839 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,839 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xe0f\xa6f\x8a\xa2\xcf\x01\xe0f\xa6f\x8a\xa2\xcf\x01\xe0f\xa6f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x15\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,849 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,849 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,860 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,860 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10\xee\xa7f\x8a\xa2\xcf\x01\x10\xee\xa7f\x8a\xa2\xcf\x01\x10\xee\xa7f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,860 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,860 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,860 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@u\xa9f\x8a\xa2\xcf\x01\x10\xee\xa7f\x8a\xa2\xcf\x01\x10\xee\xa7f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,860 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,860 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,860 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,860 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01@u\xa9f\x8a\xa2\xcf\x01@u\xa9f\x8a\xa2\xcf\x01@u\xa9f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x16\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,980 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,980 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,980 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,310 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,310 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,310 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,310 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,310 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,310 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,310 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\xcb\xbbf\x8a\xa2\xcf\x01\x80\xcb\xbbf\x8a\xa2\xcf\x01\x80\xcb\xbbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,320 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,320 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,320 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,320 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,320 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,320 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,330 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\xbf\xeff\x8a\xa2\xcf\x01\x80\xcb\xbbf\x8a\xa2\xcf\x01\x80\xcb\xbbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,330 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,330 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,330 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,330 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,330 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,330 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,330 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10G\xf1f\x8a\xa2\xcf\x01\x80\xcb\xbbf\x8a\xa2\xcf\x01\x80\xcb\xbbf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,340 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,340 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,340 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,340 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,340 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,340 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,340 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01@\xce\xf2f\x8a\xa2\xcf\x01@\xce\xf2f\x8a\xa2\xcf\x01@\xce\xf2f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x17\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,390 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,390 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,390 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,390 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,390 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,390 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,390 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,400 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,400 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,400 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,400 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,400 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,400 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,400 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,400 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,400 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,410 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010r\xfaf\x8a\xa2\xcf\x010r\xfaf\x8a\xa2\xcf\x010r\xfaf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,410 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,410 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,410 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,410 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,410 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,410 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,410 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90\x80\xfdf\x8a\xa2\xcf\x010r\xfaf\x8a\xa2\xcf\x010r\xfaf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,410 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,420 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,420 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,420 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,420 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,420 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,420 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xc0\x07\xfff\x8a\xa2\xcf\x01\xc0\x07\xfff\x8a\xa2\xcf\x01\xc0\x07\xfff\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,430 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,430 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,430 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,430 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,440 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,440 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,440 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,440 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,440 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,440 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,761 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,761 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,761 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,761 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,761 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,761 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,761 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0\x8e\x00g\x8a\xa2\xcf\x01\xf0\x8e\x00g\x8a\xa2\xcf\x01\xf0\x8e\x00g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,771 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,771 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,771 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,771 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,771 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,771 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,781 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P\x834g\x8a\xa2\xcf\x01\xf0\x8e\x00g\x8a\xa2\xcf\x01\xf0\x8e\x00g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,791 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,791 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,791 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,791 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,791 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,791 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,791 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0\x917g\x8a\xa2\xcf\x01\xf0\x8e\x00g\x8a\xa2\xcf\x01\xf0\x8e\x00g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,791 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,791 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,791 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,791 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,801 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,801 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,801 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xe0\x189g\x8a\xa2\xcf\x01\xe0\x189g\x8a\xa2\xcf\x01\xe0\x189g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x19\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,961 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,961 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,971 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,971 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,971 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xe0\x8bQg\x8a\xa2\xcf\x01\xe0\x8bQg\x8a\xa2\xcf\x01\xe0\x8bQg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,971 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,971 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10\x13Sg\x8a\xa2\xcf\x01\xe0\x8bQg\x8a\xa2\xcf\x01\xe0\x8bQg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,971 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,971 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,971 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\x10\x13Sg\x8a\xa2\xcf\x01\x10\x13Sg\x8a\xa2\xcf\x01\x10\x13Sg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,981 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,981 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,981 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,981 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,981 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,981 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,981 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,981 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,981 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,981 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,292 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,292 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,292 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,292 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,292 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,292 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,292 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@\x9aTg\x8a\xa2\xcf\x01@\x9aTg\x8a\xa2\xcf\x01@\x9aTg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,302 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,302 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,302 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,302 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,302 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,312 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,312 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01@\x80\x85g\x8a\xa2\xcf\x01@\x9aTg\x8a\xa2\xcf\x01@\x9aTg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,312 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,312 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,312 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,312 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,312 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,322 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,322 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01p\x07\x87g\x8a\xa2\xcf\x01@\x9aTg\x8a\xa2\xcf\x01@\x9aTg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,322 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,322 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,322 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,322 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,322 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,322 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,322 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xa0\x8e\x88g\x8a\xa2\xcf\x01\xa0\x8e\x88g\x8a\xa2\xcf\x01\xa0\x8e\x88g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1b\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,382 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,382 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,382 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,382 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,382 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,392 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,392 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,392 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,392 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,392 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,392 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,392 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,392 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,402 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,402 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,402 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,402 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xc0\xb9\x91g\x8a\xa2\xcf\x01\xc0\xb9\x91g\x8a\xa2\xcf\x01\xc0\xb9\x91g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,402 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,402 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,402 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,402 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,402 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,412 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,412 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \xc8\x94g\x8a\xa2\xcf\x01\xc0\xb9\x91g\x8a\xa2\xcf\x01\xc0\xb9\x91g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,412 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,412 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,412 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,412 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,412 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,412 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,422 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01PO\x96g\x8a\xa2\xcf\x01PO\x96g\x8a\xa2\xcf\x01PO\x96g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,432 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,432 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,432 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,432 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,432 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,432 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,432 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,432 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,432 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,442 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,752 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,752 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,752 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,752 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0]\x99g\x8a\xa2\xcf\x01\xb0]\x99g\x8a\xa2\xcf\x01\xb0]\x99g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,762 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,762 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,762 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,762 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0C\xcag\x8a\xa2\xcf\x01\xb0]\x99g\x8a\xa2\xcf\x01\xb0]\x99g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,772 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,772 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,772 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,772 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x10R\xcdg\x8a\xa2\xcf\x01\xb0]\x99g\x8a\xa2\xcf\x01\xb0]\x99g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,782 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,782 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,782 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,782 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01@\xd9\xceg\x8a\xa2\xcf\x01@\xd9\xceg\x8a\xa2\xcf\x01@\xd9\xceg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1d\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,832 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,842 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,842 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,842 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,852 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,852 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,852 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x010}\xd6g\x8a\xa2\xcf\x010}\xd6g\x8a\xa2\xcf\x010}\xd6g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,852 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,852 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,862 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,862 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x90\x8b\xd9g\x8a\xa2\xcf\x010}\xd6g\x8a\xa2\xcf\x010}\xd6g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,862 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,862 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,862 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,862 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,862 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,862 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,862 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xc0\x12\xdbg\x8a\xa2\xcf\x01\xc0\x12\xdbg\x8a\xa2\xcf\x01\xc0\x12\xdbg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,882 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,882 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,882 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,882 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,882 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,882 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,882 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,882 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,882 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:54,882 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,203 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,203 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,203 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xf0\x99\xdcg\x8a\xa2\xcf\x01\xf0\x99\xdcg\x8a\xa2\xcf\x01\xf0\x99\xdcg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,203 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,203 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,213 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,213 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01 \x07\x0fh\x8a\xa2\xcf\x01\xf0\x99\xdcg\x8a\xa2\xcf\x01\xf0\x99\xdcg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,213 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,213 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,213 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01P\x8e\x10h\x8a\xa2\xcf\x01\xf0\x99\xdcg\x8a\xa2\xcf\x01\xf0\x99\xdcg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,213 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,213 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,213 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,213 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01P\x8e\x10h\x8a\xa2\xcf\x01P\x8e\x10h\x8a\xa2\xcf\x01P\x8e\x10h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,223 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,223 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,223 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,223 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,223 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,223 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,223 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,233 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,233 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,233 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\x80\x15\x12h\x8a\xa2\xcf\x01\x80\x15\x12h\x8a\xa2\xcf\x01\x80\x15\x12h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,233 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,233 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x80K\x82Z\x8a\xa2\xcf\x01\xb0\x9c\x13h\x8a\xa2\xcf\x01\x80\x15\x12h\x8a\xa2\xcf\x01\x80\x15\x12h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,233 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,243 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,243 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => l\x9db\x8a\xa2\xcf\x01\xe0#\x15h\x8a\xa2\xcf\x01\xe0#\x15h\x8a\xa2\xcf\x01\xe0#\x15h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,243 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,243 | 1660 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:55,243 | 1660 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:16:05,237 | 1660 | RegOpenKeyExW |
Handle => 0x00000494 Registry => 0x80000002 SubKey => System |
SUCCESS | 0x00000000 | |
| 09:16:05,237 | 1660 | RegCloseKey |
Handle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:16:05,237 | 1660 | RegCreateKeyExW |
Handle => 0x00000494 Access => 33554432 Registry => 0x80000002 Class => SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:16:05,237 | 1660 | RegCloseKey |
Handle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:16:05,237 | 1660 | RegDeleteKeyW |
Handle => 0x80000002 SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:16:05,257 | 1660 | RegOpenKeyExW |
Handle => 0x00000494 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:16:05,257 | 1660 | RegQueryValueExW |
Handle => 0x00000494 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:16:05,257 | 1660 | RegCloseKey |
Handle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:16:05,297 | 1660 | ShellExecuteExW |
Show => 1 Parameters => /PRODUCT:Reader /VERSION:11.0 /MODE:3 FilePath => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" |
SUCCESS | 0x00000001 | |
| 09:16:08,172 | 512 | select |
socket => 0x00000003 |
SUCCESS | 0x00000001 | |
| 09:16:08,172 | 1660 | closesocket |
socket => 0x0000047c |
SUCCESS | 0x00000000 | |
| 09:16:08,172 | 1660 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x02b10a90 | |
| 09:16:08,172 | 1660 | OpenServiceW |
ServiceControlManager => 0x02b10a90 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x02b10ab8 | |
| 09:16:08,172 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:16:08,172 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:08,212 | 1660 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetCloseHandle FunctionAddress => 0x771c4d8c ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:16:09,273 | 512 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:16:09,273 | 1660 | closesocket |
socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:09,273 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:16:09,273 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:09,273 | 1660 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:16:09,273 | 1660 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:09,273 | 1660 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:16:09,273 | 1660 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:09,273 | 1660 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:16:09,283 | 512 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:16:09,283 | 512 | WSARecv |
socket => 0x000003d4 |
SUCCESS | 0x00000000 | |
| 09:16:09,283 | 1660 | send |
buffer => ! socket => 0x000003d4 |
SUCCESS | 0x00000001 | |
| 09:16:17,245 | 1468 | ExitThread |
ExitCode => 0 |
SUCCESS | 0x00000000 | 1 time |
| 09:16:30,303 | 512 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:16:30,303 | 1660 | closesocket |
socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:30,303 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:16:30,303 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:16:30,303 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:16:30,303 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:16:30,303 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:16:30,303 | 1660 | RegQueryValueExA |
Handle => 0x00000440 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:16:30,313 | 1660 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x0025aa58 | |
| 09:16:30,313 | 1660 | OpenServiceW |
ServiceControlManager => 0x0025aa58 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x0025f4d8 | |
| 09:16:30,313 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:16:30,313 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:30,323 | 1660 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:16:30,323 | 1660 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:30,323 | 1660 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:16:30,323 | 1660 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x1b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:30,323 | 1660 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:16:30,323 | 512 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:16:30,323 | 512 | WSARecv |
socket => 0x000003d4 |
SUCCESS | 0x00000000 | |
| 09:16:30,323 | 1660 | send |
buffer => ! socket => 0x000003d4 |
SUCCESS | 0x00000001 | |
| 09:16:44,163 | 780 | CreateThread |
ThreadId => 1308 StartRoutine => 0x77e76c7d Parameter => 0x001f2eb8 CreationFlags => 0 |
SUCCESS | 0x00000470 | |
| 09:16:51,233 | 512 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:16:51,233 | 1660 | closesocket |
socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:51,233 | 1660 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x02b10ae0 | |
| 09:16:51,233 | 1660 | OpenServiceW |
ServiceControlManager => 0x02b10ae0 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x002473e8 | |
| 09:16:51,233 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:16:51,243 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:51,243 | 1660 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:16:51,243 | 1660 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:51,243 | 1660 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:16:51,253 | 1660 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:51,253 | 1660 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:16:51,253 | 512 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:16:51,253 | 512 | WSARecv |
socket => 0x000003d4 |
SUCCESS | 0x00000000 | |
| 09:16:51,253 | 1660 | send |
buffer => ! socket => 0x000003d4 |
SUCCESS | 0x00000001 | |
| 09:17:12,264 | 512 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:17:12,264 | 1660 | closesocket |
socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:17:12,264 | 1660 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x02b10ae0 | |
| 09:17:12,264 | 1660 | OpenServiceW |
ServiceControlManager => 0x02b10ae0 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x02b10a90 | |
| 09:17:12,264 | 1660 | RegQueryValueExA |
Handle => 0x0000036c DataLength => 4 ValueName => EnableAutodial Type => 876 |
FAILURE | 0x00000002 | |
| 09:17:12,274 | 1660 | NtQueryInformationFile |
FileHandle => 0x00000378 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:17:12,274 | 1660 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:17:12,274 | 1660 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:17:12,274 | 1660 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:17:12,274 | 1660 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04!\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:17:12,274 | 1660 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:17:12,284 | 512 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:17:12,284 | 512 | WSARecv |
socket => 0x000003d4 |
SUCCESS | 0x00000000 | |
| 09:17:12,284 | 1660 | send |
buffer => ! socket => 0x000003d4 |
SUCCESS | 0x00000001 | |
| 09:17:13,315 | 512 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:17:13,315 | 1868 | NtDeviceIoControlFile |
InputBuffer => \x00\x00\x00\x00B<oe\x8c\x04\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x00P\x17>\x06\xa3\x00\x00\x00\x00\x00\x00\x00\x00 FileHandle => 0x00000488 OutputBuffer => |
SUCCESS | 0x00000103 |